Affected Products

• saleor/saleor

Details

Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and storefronts.

Impact

Malicious staff members could craft script injections to target other staff members, possibly stealing their access and/or refresh tokens.

Mitigations

This issue has been patched in versions: 3.22.27, 3.21.43, and 3.20.108.

IMPORTANT: if you believe you are impacted, or if you are unsure or want to verify, you should run the following command:

This scans all rich text fields and will display any differences detected. You should look for suspicious differences (e.g., unexpected javascript code) and if you want to fix the differences, run ./manage.py clean_editorjs_fields --apply

Workarounds

We strongly recommend upgrading to the latest versions, in case of inability to upgrade straight away, a possible workaround is to use client-side cleaner like DOMPurify.

References

• Issue introduced by https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335
• Documentation: https://docs.saleor.io/security/#editorjs--html-cleaning
• main patch: https://github.com/saleor/saleor/commit/b67a0b9d9f243e5d6c2f9c7643d42a54c24c90ee
• 3.22: https://github.com/saleor/saleor/commit/676d95dbc7d811610e68f2ea8f9b6652cbd58e9b
• 3.21: https://github.com/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386
• 3.20: https://github.com/saleor/saleor/commit/bb5f883aeb0f085899a9d4f35d429cf7eb07a11d

Acknowledgements

This vulnerability was reported by Quyền Vũ, and Łukasz Rybak.

References

• https://github.com/saleor/saleor/security/advisories/GHSA-8jcj-r5g2-qrpv
• https://github.com/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386
• https://github.com/saleor/saleor/commit/676d95dbc7d811610e68f2ea8f9b6652cbd58e9b
• https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335
• https://github.com/saleor/saleor/commit/b67a0b9d9f243e5d6c2f9c7643d42a54c24c90ee
• https://github.com/saleor/saleor/commit/bb5f883aeb0f085899a9d4f35d429cf7eb07a11d
• https://docs.saleor.io/security/#editorjs--html-cleaning

Disclaimer

This CVE was responsibly disclosed following coordinated vulnerability disclosure practices. The information provided here is for educational and defensive purposes only.