Summary
NPM’s package @evershop/evershop prior to 1.0.0-rc.5 contains a Stored Cross-Site Scripting (XSS) vulnerability affecting various functionalities of the Admin Panel. Attackers can particularly inject malicious code during the creation of new products. The registration of users is also affected, which means that an unauthenticated user could store malicious code during registration which will affect administrators that visit the users’ section. The latter could lead to more serious attack vectors, including account takeover.
Product
This vulnerability affects NPM’s package @evershop/evershop in versions prior to 1.0.0-rc.5.
Impact
This issue enables an attacker to store malicious code permanently on the database, which can lead to various issues.
Steps to reproduce
- Install the
@evershop/evershoppackage dependency for any version prior to 1.0.0-rc.5 - Run the EverShop Web Application on localhost
- Navigate to registering a new user
- In the “Full Name” field type:
</script><script>alert('XSS')</script> - Save the form
Expected result:
As soon as an administrator visits the “Customers” tab, the malicious code is executed and an alert will appear.
Remediation
A fix was released in commit 0b5cb6e, where input validation was implemented to protect against XSS. Users are recommended to upgrade to version 1.0.0-rc.5, which includes this fix.
Credit
This issue was discovered and reported by Checkmarx SCA Security Analyst Mário Teixeira.
