CVE-2024-21628: XSS can be stored in DB from "add a message form" in order detail page (FO)
Impact The isCleanHtml method is not used on this this form, which makes it possible to store an xss in DB. The impact is low because the html is not interpreted in BO, thanks to twig's escape mechanism. In FO, the xss is effective, but only impacts the customer sending it, or the customer session from which it was sent.
Be careful if you have a module fetching these messages from the DB and displaying it without escaping html.
Patches 8.1.x
Reporter Reported by Rona Febriana (linkedin: https://www.linkedin.com/in/rona-febriana/)
Other sources
PrestaShop is an open-source e-commerce platform. Prior to version 8.1.3, the isCleanHtml method is not used on this this form, which makes it possible to store a cross-site scripting payload in the database. The impact is low because the HTML is not interpreted in BO, thanks to twig's escape mechanism. In FO, the cross-site scripting attack is effective, but only impacts the customer sending it, or the customer session from which it was sent. This issue affects those who have a module fetching these messages from the DB and displaying it without escaping HTML. Version 8.1.3 contains a patch for this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/prestashop/prestashopto a version that resolves this vulnerability.Fixed in 8.1.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.3 - Configuration
If you have a module that fetches messages from the database and displays them in Front-Office, ensure the message content is escaped before rendering in HTML to prevent XSS (this is a concern where messages are displayed without escaping HTML).
Module fetching messages for display (PrestaShop FO) HTML escaping = escape output (use escaping)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21628?
The severity of CVE-2024-21628 is considered low due to the HTML being escaped by Twig's mechanism.
How do I fix CVE-2024-21628?
To fix CVE-2024-21628, upgrade to a version of PrestaShop that is beyond 8.1.3.
What systems are affected by CVE-2024-21628?
CVE-2024-21628 affects PrestaShop versions up to and including 8.1.3.
What type of vulnerability is CVE-2024-21628?
CVE-2024-21628 is an XSS (Cross-Site Scripting) vulnerability that could allow for potential data exposure.
Can CVE-2024-21628 be exploited in the back office?
No, CVE-2024-21628 cannot be exploited in the back office because HTML is not interpreted due to Twig's escape mechanism.