CyberRota Analysis
AI-GeneratedContao versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6 are vulnerable due to a flaw in the crawler that inadvertently leaks authentication credentials to external hosts. This occurs when Basic or Bearer authentication is configured for protected sites, allowing attackers to capture these credentials if they can manipulate the crawling process. Organizations using affected versions, particularly those with sensitive staging or production environments, should prioritize upgrading to versions 5.3.47 or 5.7.7 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes Cookie and Authorization headers, but it removes the non-Symfony option names basic_auth and bearer_auth instead of Symfony HttpClient's real auth_basic and auth_bearer options. When contao.crawl.default_http_client_options contains Basic or Bearer authentication for a protected staging/production site, those credentials remain in the "clean" client used for external links or configured additional URIs. An attacker who can get an external URL crawled, for example through a link on a crawled page while the broken-link checker is enabled, can receive the crawler credentials. This issue has been fixed in versions 5.3.47 and 5.7.7.