CVE-2024-37297 WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms
Attackers can inject malicious scripts into checkout and registration forms via manipulated links, potentially hijacking user sessions and data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-37297?
CVE-2024-37297 is a medium-severity cross-site scripting vulnerability in woocommerce, published on 12 Jun 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database, the links may be sent to victims for malicious purposes. The injected JavaScript could hijack content & data stored in the browser, including the session. The URL content is read through the `Sourcebuster.js` library and then inserted without proper sanitization to the classic checkout and registration forms. Versions 8.8.5 and 8.9.3 contain a patch for the issue. As a workaround, one may disable the Order Attribution feature.
Which versions are affected by CVE-2024-37297?
4 open source packages ship an affected version, including woocommerce/woocommerce. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
woocommerce/woocommerce Packagist | From 8.8.0 | 8.8.5 |
woocommerce/woocommerce Packagist | From 8.8.0 | 8.8.5 |
woocommerce/woocommerce Packagist | From 8.9.0 | 8.9.3 |
woocommerce/woocommerce Packagist | From 8.9.0 | 8.9.3 |
Products include Woocommerce Woocommerce.
How do I fix CVE-2024-37297?
Upgrade woocommerce/woocommerce to a fixed version for your release line: 8.8.5 or 8.9.3.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-37297 being exploited?
There is no known exploitation of CVE-2024-37297 in the wild and no public exploit code.
Other vulnerabilities in woocommerce
Sources
Also known as GHSA-cv23-q6gh-xfrf.