Magento Commerce Stored Cross-site Scripting Vulnerability

Vulnerability

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) are affected by a stored cross-site scripting (XSS) vulnerability in vulnerable form fields. The vulnerability allows an attacker to inject arbitrary JavaScript into these fields, which is then stored and executed in the browser of any user who views the page containing the injected content [1].

Exploitation

An attacker with the ability to submit data to the affected form fields can inject malicious JavaScript. No special network position or authentication is required if the form is publicly accessible; however, if the form is restricted to authenticated users, the attacker must have valid credentials. The injected script is stored on the server and executed when a victim (e.g., an administrator or other user) navigates to the page that renders the field [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser within the context of the Magento application. This can lead to session hijacking, theft of sensitive data (e.g., cookies, tokens), defacement, or further malicious actions on behalf of the victim [1].

Mitigation

Not yet disclosed in the available references. Users should monitor Adobe's security advisories for patched versions and apply updates as soon as they become available. As a general precaution, input validation and output encoding should be enforced on all form fields.