GHSA-mf2p-wjp4-99pq

### Summary

A stored cross-site scripting (XSS) vulnerability exists in REDAXO CMS 5.x. When an administrator attempts to delete a media file that is referenced by a Media Manager effect, the warning message rendered in the backend includes the type's `name` field without HTML escaping. An attacker with access to the Media Manager addon can store an XSS payload as a type name; the payload executes in the browser of any administrator who subsequently tries to delete a media file linked to that type's effects. This can lead to session hijacking and full backend account takeover.

---

### Details

**File:** `redaxo/src/addons/media_manager/lib/media_manager.php` **Function:** `mediaIsInUse()` — registered on the `MEDIA_IS_IN_USE` extension point in `boot.php`

When `rex_media_service::deleteMedia()` is called, it invokes `rex_mediapool::mediaIsInUse($filename)`, which fires the `MEDIA_IS_IN_USE` extension point. The media_manager addon's handler queries all effects whose `parameters` JSON contains the filename, then constructs an HTML anchor with the type name inserted verbatim:

```php // media_manager.php ~line 457 ← VULNERABLE $message = '<a href="javascript:openPage(\'' . rex_url::backendPage(...) . '\')">' . rex_i18n::msg('media_manager') . ' ' . rex_i18n::msg('media_manager_effect_name') . ': ' . (string) $sql->getValue('name') // ← NO rex_escape() call . '</a>'; ```

The returned `$message` string is concatenated into the exception message thrown by `deleteMedia()` and rendered by `rex_view::error()` as raw HTML.

**Contrast with the correct pattern used elsewhere in the same addon:**

```php // types.php line 91 ← CORRECT $name = '<b>' . rex_escape($list->getValue('name')) . '</b>'; ```

**Input validation gap:** `types.php` line 200 validates the type name with the rule `NOT_MATCH '{[/\\]}'`, which blocks `{`, `/`, and `\` but permits `<`, `>`, `"`, `'`, and `&` — all characters required to inject HTML.

---

### PoC

<img width="2074" height="1720" alt="image" src="https://github.com/user-attachments/assets/207f85d3-f4e2-4828-9211-8da36ec9c43d" />

**Test environment:** REDAXO 5.x running at `http://localhost/` **Account required:** Any REDAXO backend administrator **Test credentials:** username `admin` / password `Admin12345!`

#### Step 1 — Seed test data directly into the database (single CMD command)

```cmd docker exec -i 34--core-5x-redaxo-1 php -r "$p=new PDO('mysql:host=db;dbname=redaxo','redaxo','redaxo');$p->exec(\"INSERT IGNORE INTO rex_media(category_id,attributes,filetype,filename,originalname,filesize,width,height,title,createdate,createuser,updatedate,updateuser) VALUES(0,'','image/jpeg','xss_test.jpg','xss_test.jpg',284,1,1,'XSS Test',NOW(),'admin',NOW(),'admin')\");$tid=$p->query(\"SELECT id FROM rex_media_manager_type WHERE name='<img src=x onerror=alert(document.domain)>'\")->fetchColumn();if(!$tid){$p->prepare(\"INSERT INTO rex_media_manager_type(status,name,description,createdate,createuser,updatedate,updateuser) VALUES(1,?,'poc',NOW(),'admin',NOW(),'admin')\")->execute(['<img src=x onerror=alert(document.domain)>']);$tid=$p->lastInsertId();}$p->prepare(\"INSERT IGNORE INTO rex_media_manager_type_effect(type_id,effect,parameters,priority,createdate,createuser,updatedate,updateuser) VALUES(?,'watermark',?,1,NOW(),'admin',NOW(),'admin')\")->execute([$tid,json_encode(['rex_effect_watermark'=>['watermark_image'=>'xss_test.jpg']])]);echo \"OK type_id=$tid\n\";" ```

#### Step 2 — Place a 1×1 JPEG in the media directory

```cmd docker exec 34--core-5x-redaxo-1 sh -c "printf '\xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00\xff\xdb\x00C\x00\x08\x06\x06\x07\x06\x05\x08\x07\x07\x07\t\t\x08\n\x0c\x14\r\x0c\x0b\x0b\x0c\x19\x12\x13\x0f\x14\x1d\x1a\x1f\x1e\x1d\x1a\x1c\x1c $.\' \",#\x1c\x1c(7),01444\x1f\x27=82<.342\x1e>\x1b\x1b123\x1e4\x1c\x1f\xff\xc0\x00\x0b\x08\x00\x01\x00\x01\x01\x01\x11\x00\xff\xc4\x00\x1f\x00\x00\x01\x05\x01\x01\x01\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\xff\xda\x00\x08\x01\x01\x00\x00?\x00\xf5\x00\xff\xd9' > /var/www/html/media/xss_test.jpg" ```

#### Step 3 — Login to the backend

Open a browser and navigate to:

``` http://localhost/redaxo/index.php ```

Login with: **admin** / **Admin12345!**

#### Step 4 — Trigger the XSS

Navigate to the media file detail page:

``` http://localhost/redaxo/index.php?page=mediapool/media&file_id=1 ```

Click the **Delete** button. REDAXO checks whether the file is in use, finds the Watermark effect whose `parameters` JSON references `xss_test.jpg`, and renders the type name in the warning HTML without escaping.

**Result:** The browser executes `<img src=x onerror=alert(document.domain)>` and an alert dialog showing the current domain appears immediately.

---

### Impact

**Vulnerability type:** Stored Cross-Site Scripting (Stored XSS)

**Who is impacted:** Any backend administrator who attempts to delete a media file that is referenced by a Media Manager effect. A malicious administrator (or an attacker who has compromised any admin account) can pre-plant a payload in a type name. All other administrators who later try to delete affected media files will have the payload executed in their browser sessions.

**Exploitability:** - Privilege required to plant: Administrator (access to Media Manager addon) - Privilege required to trigger: Administrator (access to Mediapool) - User interaction required: Victim must click "Delete" on a media file

**Realistic attack scenarios:** - Session cookie theft via `document.cookie` exfiltration (leads to full account takeover) - Credential harvesting by dynamically replacing the login form - CSRF-token extraction to perform authenticated actions on behalf of the victim

---

### Fix

Apply `rex_escape()` to the type name before concatenating it into the HTML anchor:

```php // media_manager.php — apply rex_escape() to the name value $message = '<a href="javascript:openPage(\'' . rex_url::backendPage(...) . '\')">' . rex_i18n::msg('media_manager') . ' ' . rex_i18n::msg('media_manager_effect_name') . ': ' . rex_escape((string) $sql->getValue('name')) // ← ADD rex_escape() . '</a>'; ```