Description
Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can store executable media on the administrator's own origin. In the 2.x implementation, relevant upload permissions include `edit_products` or `add_brands`, and `packages/admin/config/media.php` allows `image/svg+xml` in every media collection, including image fields whose image/* validation also accepts SVG. The product files collection in `packages/admin/src/Livewire/Components/Products/Form/Files.php` has no MIME restriction and accepts `text/html` as well. Media is served inline from the `public` disk under `/storage/` with its own content type, without `Content-Disposition: attachment` or a `Content-Security-Policy`. When an administrator opens an uploaded HTML or SVG file, stored script executes in that administrator's session. In 2.x, the script can invoke `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, whose `store()` checks `access_setting` held by the viewing administrator but trusts client-supplied `role_id`, to create a new attacker-controlled administrator with a chosen password. This account persists after the uploaded file is deleted and gives access to customer data, orders, settings, and user/role management; the same script can exfiltrate data or grant permissions to the attacker's account. Direct account creation by the low-privileged uploader…
References
- https://github.com/shopperlabs/shopper/commit/12be681db5f603a364d5f03f1974ff2a20e99b99
- https://github.com/shopperlabs/shopper/commit/ad2c5b9b968ff49c37130c6b9d1dba7f20eebbf6
- https://github.com/shopperlabs/shopper/compare/v3.0.0-beta.1...v3.0.0-beta.3
- https://github.com/shopperlabs/shopper/pull/595
- https://github.com/shopperlabs/shopper/pull/597
Collected automatically from public sources. Verify affected versions and fixes in the vendor's notice before acting.