PT-2021-16886 · Shuup · Shuup

Published 2021-09-29 · Updated 2021-10-06 · CVE-2021-25962

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shuup versions 0.4.2 through 2.10.8

Description The issue allows a customer to inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses the reports page to export the data as an Excel file and opens it, the payload gets executed. This is related to a "Formula Injection" issue.

Recommendations For versions 0.4.2 through 2.10.8, consider restricting access to the billing address input field to prevent payload injection until a patch is available. As a temporary workaround, consider disabling the export of data as an Excel file from the reports page until the issue is resolved. Avoid using the name input field in the billing address for any critical operations until the vulnerability is fixed.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2021-25962

GHSA-663J-RJCR-789F

PYSEC-2021-355

Affected Products

Shuup

References · 12

• https://github.com/shuup/shuup/commit/0a2db392e8518410c282412561461cd8797eea51 · Patch
• https://osv.dev/vulnerability/GHSA-663j-rjcr-789f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25962 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25962 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-355 · Vendor Advisory
• https://github.com/shuup/shuup · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/shuup/PYSEC-2021-355.yaml · Note
• https://t.me/cvenotify/22019 · Telegram Post
• https://t.me/cibsecurity/29646 · Telegram Post
• https://github.com/advisories/GHSA-663j-rjcr-789f · Note
• https://t.me/cvenotify/21633 · Telegram Post
• https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25962 · Note