External risk intelligence

PyroCMS 3.9 Stored XSS Allows Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2022-37721

PyroCMS is a content management system typically deployed as a public-facing web application. Since the vulnerability exists within the content management interface, it is commonly exposed to the internet in standard web deployment scenarios.

Cross-site Scripting

Pyrocms

3.9

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects PyroCMS 3.9, a content management system. It allows a user with limited privileges to inject malicious code that could lead to a complete takeover of an administrator's account. The main concern is confirming if this specific software and version are in use within our environment.

A low-privilege user can take over admin accounts.
It impacts systems managing web content.
Confirm relevance and exposure within our systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by tricking a user with author privileges into creating a blog post containing malicious HTML and JavaScript. When another user, potentially an administrator, views this compromised blog post, the injected script executes within their browser session. This allows the attacker to hijack their session, potentially leading to full control over the admin account or escalating their own privileges within the system.

Requires low-privileged user access.
Triggered by viewing a crafted blog post.
Risk of admin takeover or privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

A stored cross-site scripting vulnerability in PyroCMS could allow a low-privileged user to inject malicious HTML and JavaScript into blog posts. When viewed by an administrator, this could lead to a full takeover of their account or privilege escalation.

Administrator account data and control.
Injecting crafted content into blog posts.
Full administrative account takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts PyroCMS instances. Application owners are responsible for managing the content management system and should initiate an exposure assessment by identifying all deployed instances, verifying their reachability and business criticality, and confirming ownership before planning remediation.

Application owners should own the issue.
Verify deployed instances and their reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PyroCMS?

PyroCMS is an open-source content management system built on the Laravel framework. It provides a modular structure for developers to build websites and manage digital content. Users rely on its interface to create, organize, and publish web pages and blog posts within a centralized dashboard.

What does CVE-2022-37721 mean?

This CVE identifies a Stored Cross-Site Scripting (XSS) vulnerability, classified as CWE-79. It occurs when an application fails to properly sanitize user-supplied input before storing it. In this case, malicious scripts can be saved directly into the database, where they subsequently execute in the browsers of other users who view the affected content.

How is this vulnerability triggered?

An attacker must have at least low-privileged access, such as an author account, to input a crafted payload into a blog post. Simply having the software installed does not trigger the bug; the malicious script must be actively submitted into the content system. It does not trigger if the application is accessed by users who do not have permission to publish or edit posts.

Why should I care about this vulnerability?

According to Halo Surface Signal, PyroCMS is typically deployed as a public-facing web application. Because the vulnerability exists within the content management interface, any instance accessible via the internet may be at higher risk. An attacker can use this flaw to compromise administrator accounts, granting them full control over the website's management functions.

What should I do if I use PyroCMS?

If you manage PyroCMS instances, start by identifying all deployed versions to see if any are running 3.9. Confirm which instances are accessible over the network and determine their business importance. Once identified, ensure that access controls are strictly managed, limiting the ability of low-privileged users to publish content until you have a plan to apply the necessary software updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.