GHSA-rrgw-3hg3-9x8c XSS vulnerability in translations
An admin can inject JavaScript into translation values, leading to XSS attacks when translations are enabled or installed.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-rrgw-3hg3-9x8c?
GHSA-rrgw-3hg3-9x8c is a cross-site scripting vulnerability in oro/platform, published on 12 Jan 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Summary
An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via:
- Translation management UI.
- Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack poisoned translation should be enabled, downloaded, and installed.
- Translations uploaded via Upload translation file on the All Languages grid
Workarounds
There are no workarounds that address this vulnerability.
Which versions are affected by GHSA-rrgw-3hg3-9x8c?
6 open source packages ship an affected version, including oro/platform.
| Package | Affected | Fixed in |
|---|---|---|
oro/platform Packagist | From 3.1.0 | 3.1.29 |
oro/platform Packagist | From 3.1.0 | 3.1.29 |
oro/platform Packagist | From 4.1.0 | 4.1.17 |
oro/platform Packagist | From 4.1.0 | 4.1.17 |
oro/platform Packagist | From 4.2.0 | 4.2.8 |
oro/platform Packagist | From 4.2.0 | 4.2.8 |
How do I fix GHSA-rrgw-3hg3-9x8c?
Upgrade oro/platform to a fixed version for your release line: 3.1.29, 4.1.17 or 4.2.8.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-rrgw-3hg3-9x8c being exploited?
There is no known exploitation of GHSA-rrgw-3hg3-9x8c in the wild and no public exploit code.