Stored XSS in Bagisto via Client-Side Template Injection

Compliance Impact

The provided information does not explicitly discuss the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Bagisto versions before 2.4.4 and is a stored cross-site scripting (XSS) issue caused by client-side template injection.

An unauthenticated attacker can exploit this by registering a customer account with malicious JavaScript code embedded in the first or last name fields.

The problem arises because the create.blade.php template renders these customer name fields without using the Vue.js v-pre directive, which means Vue.js processes and executes the stored template expressions as live JavaScript.

When an administrator opens the Create Order page for the affected customer, the malicious script runs in their browser.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript code in the browsers of administrators.

Potential impacts include theft of administrator session tokens, unauthorized actions performed with administrator privileges, and possible compromise of the administrative interface.

Since the attacker can inject scripts without authentication, it increases the risk of persistent attacks against the administrative users.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves stored cross-site scripting via client-side template injection in Bagisto versions before 2.4.4. Detection involves identifying customer accounts with malicious payloads in the first or last name fields that could trigger JavaScript execution in administrator browsers.

Since the vulnerability is triggered when an administrator opens the Create Order page for a customer with a malicious name field, detection can focus on inspecting customer records for suspicious template expressions or JavaScript payloads in these fields.

There are no specific commands provided in the available resources to detect this vulnerability automatically.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to update Bagisto to version 2.4.4 or later, where this vulnerability has been fixed by adding the Vue.js v-pre directive to the create.blade.php template to prevent client-side template injection.

Until the update can be applied, administrators should avoid opening the Create Order page for customer accounts that might contain malicious payloads in their name fields.

Useful 0 Not Useful 0