Summary
NPM’s package @evershop/evershop prior to 1.0.0-rc.5 contains a Reflected Cross-Site Scripting (XSS) vulnerability in the Admin Panel. This security flaw allows attackers to inject malicious code into the application’s admin panel, particularly in the “Product Name” and “SKU” input fields when searching for products, leading to the execution of unauthorized JavaScript code in the browser. Other similar input fields are also affected.
Product
This vulnerability affects NPM’s package @evershop/evershop in versions prior to 1.0.0-rc.5.
Impact
This issue enables an attacker to execute an unauthorized JavaScript code in the browser.
Steps to reproduce
- Install the
@evershop/evershoppackage dependency for any version prior to 1.0.0-rc.5 - Run the EverShop Web Application on localhost
- Navigate to the endpoint
admin/products - Use the following query parameter:
name=%3C%2Fscript%3E%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E
Expected result:
A pop-up alert with the message “XSS” will appear.
Remediation
A fix was released in commit 0b5cb6e, where input validation was implemented to protect against XSS. Users are recommended to upgrade to version 1.0.0-rc.5, which includes this fix.
Credit
This issue was discovered and reported by Checkmarx SCA Security Analyst Mário Teixeira.
