Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-3841

CVE-2021-3841: Cross site scripting in sylius/sylius

4.1

CVSS Score
3.0

Basic Information

CVE ID
CVE-2021-3841
GHSA ID
GHSA-hhvr-2q69-4563
EPSS Score
0.14321%
CWE
CWE-79
Published
11/15/2024
Updated
11/15/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
sylius/syliuscomposer< 1.9.101.9.10
sylius/syliuscomposer>= 1.10.0, < 1.10.111.10.11
sylius/syliuscomposer>= 1.11.0, < 1.11.21.11.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper sanitization of SVG uploads. The key evidence is in the ImageUploader.php diff showing the addition of SVG sanitization using enshrined/svg-sanitize. The original vulnerable implementation (prior to patch) directly wrote file contents without sanitization. The commit adds a new sanitizeContent() method that specifically handles SVG sanitization, indicating this was the missing security check. The CWE-79 classification and advisory details about SVG-based XSS corroborate that the image upload processing was the vulnerable path.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

sylius/sylius v*rsions prior to *.*.**, *.**.**, *n* *.**.* *r* vuln*r**l* to stor** *ross-sit* s*riptin* (XSS) t*rou** SV* *il*s. T*is vuln*r**ility *llows *tt**k*rs to inj**t m*li*ious s*ripts t**t **n ** *x**ut** in t** *ont*xt o* t** us*r's *rows

Reasoning

T** vuln*r**ility st*ms *rom improp*r s*nitiz*tion o* SV* uplo**s. T** k*y *vi**n** is in t** `Im***Uplo***r.p*p` *i** s*owin* t** ***ition o* SV* s*nitiz*tion usin* *ns*rin**/sv*-s*nitiz*. T** ori*in*l vuln*r**l* impl*m*nt*tion (prior to p*t**) *ir*