CVE-2021-3841: Sylius Package Vulnerability Leading to Stored XSS via SVG Files
Summary
CVE-2021-3841: Cross site scripting in sylius/sylius. Affects sylius/sylius across 3 version ranges.
< 1.9.10
>= 1.10.0, < 1.10.11
>= 1.11.0, < 1.11.2
Fixed in 1.9.10, 1.10.11 or 1.11.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sylius is an open-source eCommerce framework built on Symfony, designed to provide a flexible and customizable platform for online stores. It offers features such as product management, order processing, and customer management. However, certain versions of Sylius are vulnerable to a stored cross-site scripting (XSS) attack, particularly through the handling of SVG files, which can compromise user security.
Vulnerability Detail
The vulnerability arises from improper handling of SVG files in Sylius versions prior to 1.9.10, 1.10.11, and 1.11.2. Attackers can exploit this flaw to inject malicious scripts into the application, which are then executed in the context of the user's browser. This can lead to unauthorized actions being performed on behalf of the user, data theft, or other malicious activities. The vulnerability is classified under CWE-79, indicating its nature as a cross-site scripting issue.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.9.101.9.10composer require sylius/sylius:1.9.10 -
>= 1.10.0, < 1.10.111.10.11composer require sylius/sylius:1.10.11 -
>= 1.11.0, < 1.11.21.11.2composer require sylius/sylius:1.11.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not possible, consider disabling the upload feature for SVG files until the package can be updated. This can be done by modifying the file upload settings in your application configuration.
Conclusion
The vulnerability identified as CVE-2021-3841 poses a significant risk to users of the Sylius package due to its potential for stored XSS attacks through SVG files. It is crucial for developers to update their Sylius installations to the latest patched versions to mitigate this risk.
See every vulnerability recorded for sylius/sylius →
FAQ
CVE-2021-3841 is a vulnerability in the Sylius package that allows for stored cross-site scripting (XSS) attacks through SVG file uploads.
Sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are affected by this vulnerability.
The vulnerability can lead to unauthorized script execution in users' browsers, potentially resulting in data theft, session hijacking, or other malicious actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 4.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for sylius/sylius.
