2

How to remove catalog product list url with unwanted string and special character for XSS Vulnerability fix, i need to completely remove the special characters if any.

Example : 'magento url'?attibute_code=%27%22%3E%3Cimg%20%20src=x%20onerror=alert(%27XSSBYTheSanjok%27);%3E

Like "magento url"?color=%27%22%3E%3Cimg%20%20src=x%20onerror=alert(%27XSSBYTheSanjok%27);%3E

Anyone got any ideas?

Thanks.

Improve this question
8
  • I'm curious how attackers able to do XSS with your code. Magento already supports protecting websites from XSS.
    – Tu Van
    Dec 23, 2022 at 11:15
  • Hello Tu van , yes we have been reported vulnerability xss on one of the custom attribute. hence asked here for resolution.
    – Mohamed Abbas
    Dec 23, 2022 at 11:27
  • What Magento version is your site using? Can you reproduce the issue on your site?
    – Tu Van
    Dec 23, 2022 at 12:02
  • Magento version 2.4.4-p1 and yes I can able to reproduced in my local (Xampp)
    – Mohamed Abbas
    Dec 23, 2022 at 12:05
  • I don't have version 2.4.4-p1 version so I can't test this issue at this time but I strongly recommend you upgrade your site (or your client site) to 2.4.4-p2. It is a security patches release that has small changes so it won't take time. And apply the security hotfix for CVE-2022-35698 experienceleague.adobe.com/docs/commerce-knowledge-base/kb/…
    – Tu Van
    Dec 23, 2022 at 12:23

1 Answer 1

Reset to default
0

color=%27%22%3E%3Cimg%20%20src=x%20onerror=alert(%27XSSBYTheSanjok%27);%3E is URL encoded, the browser will decode it as ?color='"><img src=x onerror=alert('XSSBYTheSanjok');> which is not harmful.

I strongly recommend you upgrade your site (or your client site) to Magento 2.4.5-p1 or at least 2.4.4-p2, it is a security patches release that has small changes so it won't take time. And apply the security hotfix for CVE-2022-35698 https://experienceleague.adobe.com/docs/commerce-knowledge-base/kb/troubleshooting/known-issues-patches-attached/adobe-commerce-2.4.3-p2-2.4.5-security-hotfix-for-cve-2022-35698.html

Improve this answer
1
  • No. its not encoded and when i hit the site, its alert with text.
    – Mohamed Abbas
    Dec 23, 2022 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.