Summary
Frappe ERPNext contains a stored cross-site scripting vulnerability in a tool view that renders stored record names without appropriate escaping. An authenticated user who can create records may place malicious content in a record name, causing script to run in the session of another user who later opens the affected tool.
Frappe ERPNext contains a stored cross-site scripting vulnerability in a tool view that renders stored record names without appropriate escaping. An authenticated user who can create records may place malicious content in a record name, causing script to run in the session of another user who later opens the affected tool.
Affected context
The issue occurs in ERPNext tool views that display user-controlled record names in generated markup. It becomes risky when an authenticated user can create or rename records, the application stores those names, and another user later accesses the affected view without sufficient output encoding.
The issue occurs in ERPNext tool views that display user-controlled record names in generated markup. It becomes risky when an authenticated user can create or rename records, the application stores those names, and another user later accesses the affected view without sufficient output encoding.
Exploit preconditions
- Attack surface: ERPNext web application tool views
- Required access: Authenticated permission to create or modify records whose names are displayed by the affected tool
- Trigger point: A victim opens the tool view containing the stored record name
- Why exploitation is possible: Stored record content is interpolated into markup without context-appropriate HTML escaping
- Attack surface: ERPNext web application tool views
- Required access: Authenticated permission to create or modify records whose names are displayed by the affected tool
- Trigger point: A victim opens the tool view containing the stored record name
- Why exploitation is possible: Stored record content is interpolated into markup without context-appropriate HTML escaping
Why this happens
The vulnerability results from treating stored record names as trusted markup rather than untrusted data. When user-controlled values are inserted into an HTML response without suitable output encoding, browsers may interpret the value as active script. This behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting.
The vulnerability results from treating stored record names as trusted markup rather than untrusted data. When user-controlled values are inserted into an HTML response without suitable output encoding, browsers may interpret the value as active script. This behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting.
Potential impact
- A victim's authenticated browser session could execute attacker-controlled script
- Sensitive information visible to the victim could be exposed
- Actions could be performed with the victim's application permissions
- User interface content or workflows could be altered
- Accounts or tenant data could be affected, depending on the victim's privileges
- A victim's authenticated browser session could execute attacker-controlled script
- Sensitive information visible to the victim could be exposed
- Actions could be performed with the victim's application permissions
- User interface content or workflows could be altered
- Accounts or tenant data could be affected, depending on the victim's privileges
General mitigation guidance
Mitigation generally focuses on treating all record names and other stored fields as untrusted at every rendering boundary.
Common defensive patterns include:
- Applying context-appropriate output encoding when inserting values into HTML, attributes, URLs, or scripts
- Preferencing safe DOM and templating APIs that insert text rather than interpret markup
- Enforcing server-side validation and conservative character policies for record names where appropriate
- Applying a restrictive Content Security Policy as defense in depth
- Limiting user and service-account permissions according to least privilege
- Avoiding reliance on input validation alone, since stored content may reach multiple output contexts
Mitigation generally focuses on treating all record names and other stored fields as untrusted at every rendering boundary.
Common defensive patterns include:
- Applying context-appropriate output encoding when inserting values into HTML, attributes, URLs, or scripts
- Preferencing safe DOM and templating APIs that insert text rather than interpret markup
- Enforcing server-side validation and conservative character policies for record names where appropriate
- Applying a restrictive Content Security Policy as defense in depth
- Limiting user and service-account permissions according to least privilege
- Avoiding reliance on input validation alone, since stored content may reach multiple output contexts
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis rules for unescaped template interpolation and unsafe HTML construction
- Code review checks for stored fields rendered in tool views, tables, and client-side templates
- Dynamic testing with harmless marker values containing HTML metacharacters
- Regression tests that verify record names are rendered as text rather than interpreted as markup
- Policy enforcement requiring contextual encoding or approved safe rendering APIs
- Automated application security testing and code review tools that flag potential CWE-79 patterns
Organizations can identify similar issues through:
- Static analysis rules for unescaped template interpolation and unsafe HTML construction
- Code review checks for stored fields rendered in tool views, tables, and client-side templates
- Dynamic testing with harmless marker values containing HTML metacharacters
- Regression tests that verify record names are rendered as text rather than interpreted as markup
- Policy enforcement requiring contextual encoding or approved safe rendering APIs
- Automated application security testing and code review tools that flag potential CWE-79 patterns
