Configured Commerce Security Advisory - COM-2024-01

  • Updated

 

Brief Description:

A high-severity stored cross-site scripting (XSS) vulnerability was identified in the Commerce B2B application, affecting multiple components. The vulnerability allowed malicious payloads to be stored and subsequently executed in users' browsers under specific conditions. Below are the instances that were identified and have now been fixed:

  • Upload of SVG Files Containing XSS Payloads:
    Application’s users could upload SVG files containing JavaScript-based XSS payloads. These files bypassed input validation and were accessible without authentication, posing a risk of malicious script execution.
  • Client-Side Template Injection in Search History:
    Search history entries within the application processed template expressions, which could allow XSS payloads to be stored and executed when users accessed their saved search queries.
  • Client-Side Template Injection in Lists:
    Template expressions in list item names could be stored as XSS payloads. These payloads would execute when other users interacted with the affected lists, particularly in shared or collaborative scenarios.

 

Affected Versions:

All versions prior to the 5.2.2408 (STS) and 5.2.2408 (LTS).


Solutions and Mitigations:

Users should upgrade to versions 5.2.2408 (STS) and 5.2.2408 (LTS). 

 

For Users that Cannot Upgrade:

For those unable to upgrade immediately, the following mitigations are recommended:

  • Disable file uploads for untrusted users or implement strict content validation on SVG files.
  • Disable template processing in search history and list components or implement input sanitization.

 

CVSS and Severity:

CVSS 8.1, High


CVE ID:

CVE-2024-56173, CVE-2024-56174, CVE-2024-57175


Date Published:

October 4, 2024