Summary
Frappe ERPNext contains a stored cross-site scripting vulnerability in a report view that renders saved record names without escaping them. An authenticated user who can create records may store a crafted name that executes script in the browser session of another user who opens the affected report.
Frappe ERPNext contains a stored cross-site scripting vulnerability in a report view that renders saved record names without escaping them. An authenticated user who can create records may store a crafted name that executes script in the browser session of another user who opens the affected report.
Affected context
The vulnerability occurs in ERPNext report views that interpolate stored record names into generated markup without applying context-appropriate output encoding. It is relevant where authenticated users can create or edit records and other users can later access reports displaying those names.
The vulnerability occurs in ERPNext report views that interpolate stored record names into generated markup without applying context-appropriate output encoding. It is relevant where authenticated users can create or edit records and other users can later access reports displaying those names.
Exploit preconditions
- Attack surface: Authenticated ERPNext report views
- Required access: Permission to create or modify records whose names are later displayed
- Trigger point: A victim opens a report containing the crafted stored record name
- Why exploitation is possible: Stored input is inserted into markup without sufficient escaping, allowing browser-interpreted script content to execute in the victim's session
- Attack surface: Authenticated ERPNext report views
- Required access: Permission to create or modify records whose names are later displayed
- Trigger point: A victim opens a report containing the crafted stored record name
- Why exploitation is possible: Stored input is inserted into markup without sufficient escaping, allowing browser-interpreted script content to execute in the victim's session
Why this happens
The underlying defect is insufficient output encoding when a stored record name is incorporated into HTML or other browser-interpreted markup. This behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation, because attacker-controlled data is treated as presentation markup rather than safely encoded text.
The underlying defect is insufficient output encoding when a stored record name is incorporated into HTML or other browser-interpreted markup. This behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation, because attacker-controlled data is treated as presentation markup rather than safely encoded text.
Potential impact
- Unauthorized actions may be performed through a victim's authenticated session
- Sensitive data visible to the victim may be exposed
- Session or application tokens could be targeted where browser protections are insufficient
- Malicious content may be propagated to additional report users
- User trust and application integrity could be affected
- Unauthorized actions may be performed through a victim's authenticated session
- Sensitive data visible to the victim may be exposed
- Session or application tokens could be targeted where browser protections are insufficient
- Malicious content may be propagated to additional report users
- User trust and application integrity could be affected
General mitigation guidance
Mitigation generally centers on treating record names and other persisted fields as untrusted whenever they reach a browser.
Common defensive patterns include:
- Applying context-appropriate output encoding at every markup-rendering boundary
- Using safe templating and DOM APIs that insert untrusted values as text rather than markup
- Validating and constraining record-name input without relying on validation as a replacement for encoding
- Limiting report access and record-creation privileges according to least privilege
- Using browser security controls such as a restrictive Content Security Policy as defense in depth
- Avoiding unsafe HTML rendering unless content is explicitly sanitized and its trust boundary is documented
Mitigation generally centers on treating record names and other persisted fields as untrusted whenever they reach a browser.
Common defensive patterns include:
- Applying context-appropriate output encoding at every markup-rendering boundary
- Using safe templating and DOM APIs that insert untrusted values as text rather than markup
- Validating and constraining record-name input without relying on validation as a replacement for encoding
- Limiting report access and record-creation privileges according to least privilege
- Using browser security controls such as a restrictive Content Security Policy as defense in depth
- Avoiding unsafe HTML rendering unless content is explicitly sanitized and its trust boundary is documented
How teams detect issues like this
Detection can include static analysis for string interpolation or concatenation of stored fields into HTML, templates, and client-side markup. Code review should examine report renderers, formatter callbacks, and UI components for missing context-aware escaping. Dynamic testing can use inert XSS markers in authorized test environments to verify that record names are rendered as text. Policy enforcement may require approved templating helpers, output-encoding libraries, and security checks in CI; automated review tools can help identify suspicious rendering paths.
Detection can include static analysis for string interpolation or concatenation of stored fields into HTML, templates, and client-side markup. Code review should examine report renderers, formatter callbacks, and UI components for missing context-aware escaping. Dynamic testing can use inert XSS markers in authorized test environments to verify that record names are rendered as text. Policy enforcement may require approved templating helpers, output-encoding libraries, and security checks in CI; automated review tools can help identify suspicious rendering paths.
