Executive Summary

CVE-2021-47885 is a medium severity non-persistent cross-site scripting (XSS) vulnerability found in multiple versions of CriticalGears' payment terminals, including Authorize.net, Stripe, and PayPal PRO Payment Terminals. The vulnerability exists in billing and payment information input fields such as Description, Firstname, Lastname, Address, City, and Email. Attackers can inject malicious scripts via POST requests without authentication by exploiting improper input validation and sanitization, especially in an 'onkeyup' event handler that fails to properly sanitize input. This allows the injected scripts to execute on the client side. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to session hijacking, phishing attacks, external redirects to malicious sites, and manipulation of application modules. Attackers can manipulate client-side requests by injecting malicious scripts into vulnerable input fields, potentially compromising user sessions and redirecting users to harmful content. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the vulnerable payment terminal forms for non-persistent cross-site scripting (XSS) by injecting malicious script payloads into the input fields such as Description, Firstname, Lastname, Address, City, and Email. Detection involves sending crafted POST requests with script code in these parameters and observing if the script executes in the client-side context. For example, using curl commands to send POST requests with payloads in the vulnerable parameters can help identify the issue. A sample command might be: curl -X POST -d "item_description=<script>alert(1)</script>&fname=test&lname=test&address=test&city=test&[email protected]" https://target-payment-terminal-url/endpoint. Successful execution of the script indicates the vulnerability. Additionally, manual or automated web application scanners that test for reflected XSS in these input fields can be used. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing strict input validation and sanitization on all billing and payment information input fields, especially the parameters item_description, fname, lname, address, city, and email. This involves escaping or parsing user input to prevent script execution. Securing or removing the vulnerable onkeyup event handler (checkFieldBack) that improperly handles invalid input exceptions is critical to avoid executing injected scripts. Applying patches or updates from the vendor that address these XSS flaws is recommended. Additionally, monitoring and filtering incoming requests to detect and block malicious payloads can help reduce risk until a full fix is applied. [1]

Useful 0 Not Useful 0