REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

QFinch assessment

A stored cross-site scripting (XSS) vulnerability exists in REDAXO CMS 5.x. When an administrator attempts to delete a media file that is referenced by a Media Manager effect, the warning message rendered in the backend includes the type's name field without HTML escaping. An attacker with access to the Media Manager addon can store an XSS payload as a type name; the payload executes in the browser of any administrator who subsequently tries to delete a media file linked to that type's effects. This can lead to session hijacking and full backend account takeover. ---

Potential impact

Vulnerability type: Stored Cross-Site Scripting (Stored XSS) Who is impacted: Any backend administrator who attempts to delete a media file that is referenced by a Media Manager effect. A malicious administrator (or an attacker who has compromised any admin account) can pre-plant a payload in a type name. All other administrators who later try to delete affected media files will have the payload executed in their browser sessions. Exploitability: - Privilege required to plant: Administrator (access to Media Manager addon) - Privilege required to trigger: Administrator (access to Mediapool) - User interaction required: Victim must click "Delete" on a media file Realistic attack scenarios: - Session cookie theft via document.cookie exfiltration (leads to full account takeover) - Credential harvesting by dynamically replacing the login form - CSRF-token extraction to perform authenticated actions on behalf of the victim ---

Technical context

File: redaxo/src/addons/mediamanager/lib/mediamanager.php Function: mediaIsInUse() — registered on the MEDIAISINUSE extension point in boot.php When rexmediaservice::deleteMedia() is called, it invokes rexmediapool::mediaIsInUse($filename), which fires the MEDIAISINUSE extension point. The mediamanager addon's handler queries all effects whose parameters JSON contains the filename, then constructs an HTML anchor with the type name inserted verbatim: The returned $message string is concatenated into the exception message thrown by deleteMedia() and rendered by rexview::error() as raw HTML. Contrast with the correct pattern used elsewhere in the same addon: Input validation gap: types.php line 200 validates the type name with the rule NOTMATCH '{[/\\]}', which blocks {, /, and \ but permits <, >, ", ', and & — all characters required to inject HTML. ---