CVE-2024-34349

Vulnerability

Description

CVE-2024-34349 is a stored cross-site scripting (XSS) vulnerability in Sylius, an open-source eCommerce platform. The flaw exists in the Admin Panel, where the "Name" field of resources such as Taxons, Products, Product Options, and Product Variants does not properly sanitize user input. An attacker with appropriate admin privileges can inject malicious JavaScript code into these fields [1].

Exploitation

To exploit this vulnerability, an attacker must have access to the Admin Panel and the ability to edit the Name fields of the mentioned resources. The injected script is stored and later executed when the autocomplete field (used for selecting these entities) renders the name, or when the category tree component on the product form displays taxon names. The autocomplete and tree components output the name without escaping, leading to XSS [1][3].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the Admin Panel. This could lead to session hijacking, data theft, defacement, or other malicious actions performed on behalf of the authenticated admin user. The CVSS v3 base score is 4.8 (Medium), reflecting the need for authenticated access and the limited scope of impact [1].

Mitigation

The vulnerability is fixed in Sylius versions 1.12.16 and 1.13.1, as well as earlier branches (1.9.12, 1.10.16, 1.11.17). Users should upgrade to a patched version. For those unable to upgrade immediately, a workaround is provided: create a custom JavaScript file that sanitizes input using a sanitizeInput function, as detailed in the advisory [1][2].