Vulnerability
Purplemet Lab team discovered a cross-site scripting (XSS) vulnerability in eZ Publish 5.4. This version embeds an outdated third party component named VideoJS (version 3.2.0) which provides video-js.swf, a Flash file vulnerable to a cross-site scripting. The vulnerable component is bundled in eZ Publish extensions DemoBundle, ezdemo and ezdemo-ls-extension.
Solution
Update to DemoBundle v5.4.6.1, ezdemo v5.4.2.1, ezdemo-ls-extension v5.4.2.1 or latest version.
Proof of concept
The vulnerability can be triggered using the following URL:
http://ip//extension/ezdemo/design/ezdemo/flash/video-js.swf?readyFunction=alert('XSS')//
Reference
See EZSA-2020-003 security advisory.
Purplemet technology detection
Purplemet detects eZ Publish and VideoJS with version.
