Executive brief
express-cart is a popular Node.js e-commerce shopping cart application. An attacker with access to the admin page can inject malicious JavaScript code through product option fields, allowing arbitrary code execution within the admin interface. This vulnerability is limited to administrative users and does not affect customer-facing pages.
Technical details
This is a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in the admin product management interface of express-cart. The vulnerability exists because user input for product options is not properly sanitized or escaped before being rendered in the admin page. An attacker who can access the admin interface can inject arbitrary JavaScript that will execute in the browser of any admin user viewing the products. While the attack surface is limited to authenticated admin users, successful exploitation could lead to account compromise, data exfiltration, or unauthorized administrative actions. No patch has been released; users should consider alternative e-commerce solutions.
Affected products
- express-cart express-cart all versions
Timeline
- 2020-09-02: disclosed
- 2020-09-02: advisory