CVE-2019-7868: Magento Cross-site Scripting in the admin panel
Summary
CVE-2019-7868: Magento Cross-site Scripting in the admin panel. Affects magento/community-edition across 3 version ranges.
>= 2.1.0, < 2.1.18
>= 2.2.0, < 2.2.9
>= 2.3.0, < 2.3.2
Fixed in 2.1.18, 2.2.9 or 2.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is an open-source e-commerce platform used for building online stores. It provides a wide range of features for managing products, orders, and customer data. The vulnerability in question affects Magento versions 2.1 prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2. This vulnerability specifically impacts the admin panel of Magento, where an authenticated user with permissions to manage tax rules can exploit a stored cross-site scripting vulnerability.
Vulnerability Detail
The stored cross-site scripting vulnerability allows an attacker to inject malicious code into the admin panel of Magento. This can be achieved by submitting specially crafted input that is not properly sanitized or validated. Once the malicious code is stored, it can be executed when other users, including administrators, access the affected pages. This can lead to various security risks, such as session hijacking, data theft, or unauthorized actions performed on behalf of the user.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.1.0, < 2.1.182.1.18composer require magento/community-edition:2.1.18 -
>= 2.2.0, < 2.2.92.2.9composer require magento/community-edition:2.2.9 -
>= 2.3.0, < 2.3.22.3.2composer require magento/community-edition:2.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not possible, a temporary workaround is to restrict access to the admin panel only to trusted users. This can be achieved by implementing IP whitelisting or using a firewall to block access to the admin panel from external networks. However, this workaround should only be considered as a temporary measure until the proper patch can be applied.
Conclusion
In conclusion, the stored cross-site scripting vulnerability in the admin panel of Magento can be exploited by an authenticated user with permissions to manage tax rules. It is crucial to update Magento to the latest patched version to mitigate the risk. If immediate patching is not possible, restricting access to the admin panel and implementing other security measures can serve as temporary workarounds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for magento/community-edition →
FAQ
A stored cross-site scripting vulnerability occurs when an application allows user-supplied data to be stored and later displayed to other users without proper sanitization or validation. This can enable an attacker to inject malicious code that will be executed by other users, leading to various security risks.
An authenticated user with permissions to manage tax rules in the admin panel of Magento can exploit this vulnerability. This means that an attacker would need to have valid credentials and the necessary privileges to access the affected functionality.
The consequences of this vulnerability can vary depending on the attacker's intentions. Possible ramifications include session hijacking, data theft, unauthorized actions performed on behalf of the user, and the potential compromise of sensitive information.
There have been no publicly disclosed instances of this vulnerability being exploited in the wild. However, it is important to apply the necessary patches and updates to mitigate the risk.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Magento installation is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
