PT-2022-16852 · Sylius · Sylius

Lchrusciel · Published 2022-03-14 · Updated 2022-03-22 · CVE-2022-24749

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 1.9.10 Sylius versions prior to 1.10.11 Sylius versions prior to 1.11.2

Description The issue allows uploading an SVG file containing cross-site scripting (XSS) code in the admin panel. To perform an XSS attack, the file itself has to be opened in a new card or loaded outside of the IMG tag. This problem applies to both files opened on the admin panel and shop pages.

Recommendations For versions prior to 1.9.10, update to version 1.9.10 or later. For versions prior to 1.10.11, update to version 1.10.11 or later. For versions prior to 1.11.2, update to version 1.11.2 or later. As a temporary workaround, consider requiring a library that adds on-upload file sanitization, such as enshrined/svg-sanitize, and overwriting the service before writing the file to the filesystem by using the provided ImageUploader class. Register the service in the container using the provided YAML configuration.

Exploit

Fix

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-80

CWE-434

Related Identifiers

CVE-2022-24749

GHSA-4QRP-27R3-66FJ

Affected Products

Sylius

References · 9

• 🔥 https://github.com/Sylius/Sylius/security/advisories/GHSA-4qrp-27r3-66fj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24749.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24749 · Security Note
• https://osv.dev/vulnerability/GHSA-4qrp-27r3-66fj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24749 · Vendor Advisory
• https://github.com/Sylius/Sylius · Note
• https://github.com/Sylius/Sylius/releases/tag/v1.9.10 · Note
• https://github.com/Sylius/Sylius/releases/tag/v1.10.11 · Note
• https://github.com/Sylius/Sylius/releases/tag/v1.11.2 · Note