Cross-Site Scripting (XSS) in backpack/crud (CVE-2022-31114)
Summary
Cross-site scripting in backpack/crud (CVE-2022-31114). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 4.0.63 or later.
Original description
The description as published by the source.
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Versions prior to 5.0.13, 4.1.69, and 4.0.63 are vulnerable to cross-site scripting. An attacker could conduct a targeted phishing campaign, in order to trick users or admins into clicking a malicious link, which under very specific circumstances could give them information or possibly admin access. Versions 5.0.13, 4.1.69, and 4.0.63 patch the issue. As a workaround, manually look inside error views in resources/views/errors and output e($exception->getMessage()) instead of $exception->getMessage().
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2022-31114 has been found in backpack/crud.
Risk of unauthorized operations or information disclosure.
What to do: upgrade backpack/crud to 4.0.63 or later.
If unsure, ask your IT team or search "backpack/crud CVE-2022-31114" on the vendor's site.
CVE-2022-31114 (backpack/crud) — CWE-79
Patched: 4.0.63 — apply immediately
Workaround: Alternatively (if you don’t want to run composer update), you can manually look inside your error views in “resources/views/errors” and output e($exception->getMessage()) instead of $exception->getMessage().
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Cross-site scripting (XSS) (CWE-79) exists in backpack/crud.
Check the vendor advisory for the affected versions of backpack/crud.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 4.0.63.
Workaround: Alternatively (if you don’t want to run composer update), you can manually look inside your error views in “resources/views/errors” and output e($exception->getMessage()) instead of $exception->getMessage().
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'backpack/crud' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'backpack/crud' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
backpack/crudを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
Alternatively (if you don’t want to run `composer update`), you can manually look inside your error views in “*resources/views/errors*” and output `e($exception->getMessage())` instead of `$exception->getMessage()`.パッチが適用されるまでの応急処置として、Alternatively (if you don’t want to run
composer update), you can manually look inside your error views in “resources/views/errors” and outpute($exception->getMessage())instead of$exception->getMessage(). を実施。回避策の副作用 (機能低下) を確認した上で。 -
3Apply patch patch
Upgrade backpack/crud to 4.0.63ステージング環境で 4.0.63 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web backpackforlaravel.com
- web github.com