Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping

Vulnerability

Overview CVE-2023-38219 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier, and 2.4.4-p5 and earlier. The root cause is insufficient sanitization of user input in certain form fields, allowing an attacker to inject malicious JavaScript that is subsequently stored in the admin area [1].

Exploitation

Prerequisites An attacker must have low-privileged access to the Adobe Commerce instance—such as a restricted admin account—to inject the payload into a vulnerable form field. The malicious script is persisted in the admin area and is executed when a different admin user navigates to the page containing the injected content. No additional user interaction beyond viewing the page is required for the script to execute.

Impact

Successful exploitation leads to execution of arbitrary JavaScript in the victim's browser within the admin console context. This can result in theft of sensitive data, session hijacking, or unauthorized actions performed under the victim's credentials, resulting in high confidentiality and integrity impact as defined by CVSS [1].

Mitigation

Adobe has released security updates to remediate this vulnerability: users should upgrade to Adobe Commerce 2.4.6-p3, 2.4.5-p5, 2.4.4-p6, or any later version. The Magento Open Source project, which shares the same codebase, has also incorporated these fixes in its repositories [2].