Vulnerability in getkirby/panel (CVE-2020-26253)
Summary
Vulnerability in getkirby/panel (CVE-2020-26253). Data can be tampered with by attackers. Mitigation: upgrade to 2.5.14 or later.
Original description
The description as published by the source.
Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain. In order to protect new installations on public servers that don't have an admin account for the Panel yet, we block account registration there by default. This is a security feature, which we implemented years ago in Kirby 2. It helps to avoid that you forget registering your first admin account on a public server. In this case – without our security block – someone else might theoretically be able to find your site, find out it's running on Kirby, find the Panel and then register the account first. It's an unlikely situation, but it's still a certain risk. To be able to register the first Panel account on a public server, you have to enforce the installer via a config setting. This helps to push all users to the best practice of registering your first Panel account on your local machine and upload it together with the rest of the site. This installation block implementation in Kirby versions before 3.3.6 still assumed that .dev domains are local domains, which is no longer true. In the meantime, those domains became publicly available. This means that our installation block is no longer working as expected if you use a .dev domain for your Kirby site. Additionally the local installation check may also fail if your site is behind a reverse proxy. You are only affected if you use a…
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2020-26253 has been found in getkirby/panel.
Data can be tampered with by attackers.
What to do: upgrade getkirby/panel to 2.5.14 or later.
If unsure, ask your IT team or search "getkirby/panel CVE-2020-26253" on the vendor's site.
CVE-2020-26253 (getkirby/panel) — CWE-346
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Patched: 2.5.14 — apply immediately
Workaround: Kirby 2 sites on older releases can also be patched by applying the changes from this commit.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-346) exists in getkirby/panel.
Check the vendor advisory for the affected versions of getkirby/panel.
Severity: ?. Data can be tampered with by attackers.
Update to 2.5.14.
Workaround: Kirby 2 sites on older releases can also be patched by applying the changes from this commit.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'getkirby/panel' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'getkirby/panel' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
getkirby/panelを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
Kirby 2 sites on older releases can also be patched by applying the [changes from this commit](https://github.com/getkirby-v2/panel/commit/7f9ac1876bacb89fd8f142f5e561a02ebb725baa).パッチが適用されるまでの応急処置として、Kirby 2 sites on older releases can also be patched by applying the changes from this commit. を実施。回避策の副作用 (機能低下) を確認した上で。
-
3Apply patch patch
Upgrade getkirby/panel to 2.5.14ステージング環境で 2.5.14 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- advisory github.com
- advisory packagist.org
- advisory packagist.org
- patch github.com
- patch github.com