Summary
The package Umbraco.Commerce contains a stored XSS vulnerability in the Print functionality of the order management system. The vulnerability is triggered when an admin attempts to print an order that contains malicious JavaScript injected by a user in the Billing or Shipping information fields during a purchase. This issue affects multiple fields and allows the execution of arbitrary JavaScript in the context of the admin’s session. The vulnerability was fixed by sanitizing the user inputs before rendering them in the print page.
Product
This vulnerability affects the Umbraco.Commerce package prior to versions 12.1.4 and 10.0.5.
Impact
This vulnerability allows an attacker to inject arbitrary JavaScript in order details, which gets executed when an admin prints the order. The potential impacts include privilege escalation or unauthorized actions carried out with admin privileges (such as remote code execution).
Steps to reproduce
- Place an order on the front end of the
Umbraco Commerceapplication. - Inject malicious JavaScript into the Billing/Shipping information fields.
- Log in to the backoffice as an administrator.
- Navigate to the order in question and click on “Print Order” under the following path:
/umbraco/#/commerce/commerce/order-edit/<order-id> - The injected script will execute upon printing the order.
Expected result:
The XSS is triggered, and the malicious JavaScript is executed in the context of the admin’s session.
Remediation
The issue was fixed by sanitizing user inputs in the Billing/Shipping fields before rendering them in the print page.
A fix was released on Dec 13, 2023.
Users are advised to update to Umbraco versions 10.0.5 or 12.1.4, which include this fix.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Raphael Silva.
