Log in Start free

Vulnerability · Published Mar 14, 2022 · Assigned by GitHub_M

CVE-2022-24749Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius

Medium 6.1

In plain English

A medium-severity unrestricted file upload in Sylius from Sylius. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)1.1%top 34.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the IMG tag. The problem applies both to the files opened on the admin panel and shop pages. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. As a workaround, require a library that adds on-upload file sanitization and overwrite the service before writing the file to the filesystem. The GitHub Security Advisory contains more specific information about the workaround.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistsylius/sylius1.9.10GHSA-4qrp-27r3-66fj
Packagistsylius/sylius1.10.11GHSA-4qrp-27r3-66fj
Packagistsylius/sylius1.11.2GHSA-4qrp-27r3-66fj

Affected products (as reported)

VendorProductVersions
Sylius Sylius < 1.9.10>= 1.10.0, < 1.10.11>= 1.11.0, < 1.11.2

Weakness: CWE-80, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References