-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis of the provided patch commit reveals a Server-Side Template Injection (SSTI) vulnerability in Bagisto. The vulnerability is located in the customer profile page, where the first_name and last_name of a user are displayed.
The commit 4144931da0014c696f9126132ce44d7cfbdb2761 modifies the Blade template file packages/Webkul/Shop/src/Resources/views/customers/account/profile/index.blade.php. The patch replaces the direct rendering of customer names using {{ $customer->first_name }} and {{ $customer->last_name }} with the Vue.js directive v-text. The original code caused the Blade engine to evaluate the content of the first_name and last_name fields, leading to SSTI. The use of v-text ensures the data is treated as a plain string, mitigating the vulnerability.
Based on the file path and Laravel framework conventions, the template is rendered by the index method of the Webkul\Shop\Http\Controllers\Customer\ProfileController class. This function is the primary runtime indicator for the exploitation of the vulnerability, as its execution triggers the rendering of the malicious payload.
Additionally, the update method of the same controller is identified as part of the vulnerability chain. This method handles the submission of the user's profile data and is the entry point for injecting the SSTI payload into the application's database. Although not directly patched, it is a crucial component for a successful exploit.
Webkul\Shop\Http\Controllers\Customer\ProfileController::indexpackages/Webkul/Shop/src/Resources/views/customers/account/profile/index.blade.php
Webkul\Shop\Http\Controllers\Customer\ProfileController::updatepackages/Webkul/Shop/src/Http/Controllers/Customer/ProfileController.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bagisto/bagisto | composer | < 2.3.10 | 2.3.10 |