CVE-2024-21627: Some attribute not escaped in Validate::isCleanHTML method
Description Some event attributes are not detected by the isCleanHTML method
Impact Some modules using the isCleanHTML method could be vulnerable to xss
Patches 8.1.3, 1.7.8.11
Workarounds The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of HTML type will call isCleanHTML.
Reporters
Reported by Antonio Russo (@Antonio-R1 on GitHub) and Antonio Rocco Spataro (@antoniospataro on GitHub).
Other sources
PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the isCleanHTML method. Some modules using the isCleanHTML method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of HTML type will call isCleanHTML.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/prestashop/prestashopto a version that resolves this vulnerability.Fixed in 1.7.8.11 - Upgrade
Upgrade
composer/prestashop/prestashopto a version that resolves this vulnerability.Fixed in 8.1.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.7.8.11 - Compensating control
As a workaround, sanitize any user-supplied HTML input using the `HTMLPurifier` library (available as a dependency in the PrestaShop project), especially when modules use `Validate::isCleanHTML` for event attributes.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21627?
CVE-2024-21627 has been classified as a medium severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2024-21627?
To remediate CVE-2024-21627, update your PrestaShop installation to version 8.1.3 or 1.7.8.11.
Which versions of PrestaShop are affected by CVE-2024-21627?
CVE-2024-21627 affects PrestaShop versions prior to 8.1.3 and 1.7.8.11.
What is a workaround for CVE-2024-21627 if I cannot immediately update?
A recommended workaround for CVE-2024-21627 is to use the HTMLPurifier library to sanitize HTML inputs.
What potential impact does CVE-2024-21627 have on my application?
CVE-2024-21627 could expose your application to cross-site scripting vulnerabilities, allowing attackers to inject malicious scripts.