Summary
NPM’s package @evershop/evershop prior to 1.0.0-rc.8 contains a Reflected Cross-Site Scripting (XSS) vulnerability. Attackers can exploit this issue by adding a second “sortBy” parameter to the request. This unexpected behavior will return the second “sortBy” value in the page’s code, potentially enabling the successful execution of XSS payloads.
Product
This vulnerability affects NPM’s package @evershop/evershop in versions prior to 1.0.0-rc.8.
Impact
This issue enables an attacker to execute an unauthorized JavaScript code in the browser.
Steps to reproduce
- Install the
@evershop/evershoppackage dependency for any version prior to 1.0.0-rc.8 - Run the EverShop Web Application on localhost
- Navigate to the endpoint
category/men - Use the following query parameter:
sortBy=name&sortBy=<script>alert('XSS')</script>
Expected result:
A pop-up alert with the message “XSS” will appear.
Remediation
A fix was released in commit 5aa38b0, where input validation was implemented to protect against XSS. Users are recommended to upgrade to version 1.0.0-rc.8, which includes this fix.
Credit
This issue was discovered and reported by Checkmarx SCA Security Analyst Mário Teixeira.
