Junglewise Threat Intelligence

express-cart cross-site scripting in admin

Severity: info · Published 2020-09-02

Technologies: Express-Cart. Vendors: npm.

Executive brief

express-cart is a popular Node.js e-commerce shopping cart application. An attacker with access to the admin page can inject malicious JavaScript code through product option fields, allowing arbitrary code execution within the admin interface. This vulnerability is limited to administrative users and does not affect customer-facing pages.

Technical details

This is a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in the admin product management interface of express-cart. The vulnerability exists because user input for product options is not properly sanitized or escaped before being rendered in the admin page. An attacker who can access the admin interface can inject arbitrary JavaScript that will execute in the browser of any admin user viewing the products. While the attack surface is limited to authenticated admin users, successful exploitation could lead to account compromise, data exfiltration, or unauthorized administrative actions. No patch has been released; users should consider alternative e-commerce solutions.

Affected products

  • express-cart express-cart all versions

Timeline

  • 2020-09-02: disclosed
  • 2020-09-02: advisory

References

Related threats