CVE-2024-54123: Backdrop CMS XSS Vulnerability

CVE-2024-54123 Overview

CVE-2024-54123 is a stored cross-site scripting (XSS) vulnerability in Backdrop CMS. The flaw affects versions prior to 1.28.4 and 1.29.x versions before 1.29.2. Attackers can inject malicious JavaScript through Scalable Vector Graphics (SVG) documents when the <svg> tag is permitted in a text format. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Exploitation requires user interaction, typically a victim viewing the content containing the malicious SVG. Successful exploitation can lead to session hijacking, credential theft, or administrative account takeover depending on the viewing user's privileges.

Critical Impact
Authenticated attackers with content submission rights can inject persistent JavaScript via SVG uploads, enabling session theft and privilege escalation when administrators view the content.

Affected Products

Backdrop CMS versions prior to 1.28.4
Backdrop CMS 1.29.x versions prior to 1.29.2
Any Backdrop CMS installation where the <svg> tag is enabled in a text format

Discovery Timeline

2024-11-29 - CVE-2024-54123 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54123

Vulnerability Analysis

The vulnerability resides in how Backdrop CMS processes SVG documents when the <svg> tag is included in an allowed text format. SVG is an XML-based image format that natively supports embedded scripting through elements such as <script> and event handlers like onload. When the CMS renders user-supplied SVG content without stripping these executable constructs, the browser executes the embedded JavaScript in the context of the Backdrop site origin.

The scope-changed impact reflects that injected scripts execute within the trusted security context of the Backdrop application. An authenticated contributor can therefore target higher-privileged users, including administrators, by planting a crafted SVG in content they will view.

Root Cause

The root cause is improper neutralization of active content inside SVG payloads during output rendering. Backdrop's text format filter permitted the <svg> tag but did not sufficiently sanitize script-bearing attributes and child elements within the SVG document. This allowed attacker-controlled JavaScript to persist through the storage and rendering pipeline.

Attack Vector

The attack vector is network-based with low complexity and no privileges required at the protocol layer, but exploitation requires that a target text format allow the <svg> tag and that a victim render the content. An attacker crafts an SVG file containing a <script> element or event-handler attribute carrying JavaScript. The attacker submits the SVG through any input that uses the vulnerable text format, such as a node body, comment, or block content. When another user views the rendered output, the browser parses the SVG and executes the attacker's script with the victim's session.

The vulnerability mechanism is described in the Backdrop CMS Security Advisory. No public proof-of-concept exploit is available at the time of writing.

Detection Methods for CVE-2024-54123

Indicators of Compromise

SVG files or inline <svg> markup stored in content fields containing <script> tags or on* event-handler attributes such as onload, onerror, or onclick
Unexpected outbound requests from user browsers to attacker-controlled domains following page views of Backdrop content
New or modified administrator accounts, unexpected privilege changes, or session cookies observed on untrusted hosts

Detection Strategies

Query the Backdrop database for stored content containing <svg combined with <script, javascript:, or on\w+= patterns
Review text format configurations under admin/config/content/formats to identify any format where the <svg> tag is in the allowed HTML list
Inspect web server access logs for POST requests to node, comment, or block creation endpoints with SVG payloads from low-privilege user accounts

Monitoring Recommendations

Enable and review Backdrop's watchdog or dblog entries for content submission activity by non-trusted roles
Deploy Content Security Policy (CSP) reporting to surface script execution originating from inline SVG content
Monitor administrator session activity for anomalous actions following content view events

How to Mitigate CVE-2024-54123

Immediate Actions Required

Upgrade Backdrop CMS to version 1.28.4 or 1.29.2 or later as published in the vendor advisory
Audit all enabled text formats and remove <svg> from the allowed HTML tag list unless strictly required
Review existing content for stored SVG payloads containing scripting constructs and remove or sanitize them

Patch Information

Backdrop CMS has released fixed versions 1.28.4 and 1.29.2 that address the SVG sanitization gap. Administrators should apply the update through the standard Backdrop update process. Full remediation guidance is available in the Backdrop CMS Security Advisory SA-CORE-2024-002.

Workarounds

Disable the <svg> tag in all text formats until the upgrade can be applied
Restrict content submission permissions to trusted roles only, limiting the pool of potential attackers
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to known origins

bash

# Example Content Security Policy header to mitigate inline SVG script execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"