PT-2024-25805 · Sylius · Sylius

Mpysiak · Published 2024-05-10 · Updated 2024-07-08 · CVE-2024-34349

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 1.12.16 and 1.13.1

Description There is a possibility to execute javascript code in the Admin panel. To perform an XSS attack, input a script into the Name field in which of the resources: Taxons, Products, Product Options, or Product Variants. The code will be executed while using an autocomplete field with one of the listed entities in the Admin Panel. Also, for the taxons in the category tree on the product form.

Recommendations For versions prior to 1.12.16 and 1.13.1, apply the following workarounds:

1. Create new file assets/admin/sylius-lazy-choice-tree.js with the provided JavaScript code to sanitize input.
2. Create new file assets/admin/sylius-auto-complete.js with the provided JavaScript code to sanitize input.
3. Create new file assets/admin/sylius-product-auto-complete.js with the provided JavaScript code to sanitize input.
4. Add new imports in assets/admin/entry.js for the created files.
5. Rebuild assets using yarn build. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-34349

GHSA-V2F9-RV6W-VW8R

Affected Products

Sylius

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34349.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-34349 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34349 · Security Note
• https://osv.dev/vulnerability/GHSA-v2f9-rv6w-vw8r · Vendor Advisory
• https://github.com/Sylius/Sylius · Note
• https://github.com/Sylius/Sylius/commit/ba4b66da5af88cdb1bba6174de8bdf42f4853e12 · Note
• https://github.com/Sylius/Sylius/security/advisories/GHSA-v2f9-rv6w-vw8r · Note