CVE-2024-27499: Bagist Cross-site Scripting vulnerability
Summary
CVE-2024-27499: Bagist Cross-site Scripting vulnerability. Affects bagisto/bagisto versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bagisto is an open-source e-commerce platform built on Laravel. It provides a comprehensive set of functionalities for creating online stores. The package 'bagisto/bagisto' is a core component of Bagisto, responsible for managing product reviews. It allows users to upload PNG files as part of their reviews. However, a vulnerability in this functionality exposes Bagisto to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from a lack of proper input sanitization and validation when processing PNG file uploads in the product review option. An attacker can exploit this by uploading a malicious PNG file containing embedded JavaScript code. When the review is viewed by other users, the JavaScript code gets executed in their browsers, leading to potential unauthorized actions, data theft, or further exploitation. The impact of this vulnerability is considered moderate.
How To Fix
Minimum fixed version
2.1.0
This is the first release that contains the fix.
composer require bagisto/bagisto:2.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the provided fix by upgrading the 'bagisto/bagisto' package to a version that includes the patch.
Conclusion
Bagisto is vulnerable to a cross-site scripting (XSS) attack due to a lack of input sanitization and validation when processing PNG file uploads in the product review option. To mitigate this vulnerability, it is crucial to upgrade the 'bagisto/bagisto' package to version 2.1.0 or a later release that includes the fix. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bagisto/bagisto →
FAQ
Bagisto is an open-source e-commerce platform built on Laravel. It provides a comprehensive set of functionalities for creating online stores.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized actions, data theft, or further exploitation.
The vulnerability in Bagisto allows attackers to execute arbitrary JavaScript code in the browsers of users who view a product review containing a malicious PNG file. This can result in unauthorized actions, data theft, or further exploitation.
Yes, the Bagisto development team has released a patch in version 2.1.0 of the 'bagisto/bagisto' package to address this vulnerability.
To protect your Bagisto installation, it is recommended to upgrade the 'bagisto/bagisto' package to version 2.1.0 or any subsequent releases that include the fix for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for bagisto/bagisto.
