Summary
A stored cross-site scripting vulnerability in Frappe ERPNext allows malicious content saved in a record field to be rendered without proper escaping in an HTML attribute context. When a privileged user opens the affected page, the stored script may execute in that user's browser and could enable account takeover.
A stored cross-site scripting vulnerability in Frappe ERPNext allows malicious content saved in a record field to be rendered without proper escaping in an HTML attribute context. When a privileged user opens the affected page, the stored script may execute in that user's browser and could enable account takeover.
Affected context
The issue may occur in ERPNext deployments where:
- A low-privilege user can create or modify records containing attacker-controlled field values
- Those values are later inserted into HTML attributes
- The rendering path does not apply context-appropriate output encoding
- A privileged user views the affected record or page
Exploitation depends on the vulnerable page being reachable by a victim with elevated privileges.
The issue may occur in ERPNext deployments where:
- A low-privilege user can create or modify records containing attacker-controlled field values
- Those values are later inserted into HTML attributes
- The rendering path does not apply context-appropriate output encoding
- A privileged user views the affected record or page
Exploitation depends on the vulnerable page being reachable by a victim with elevated privileges.
Exploit preconditions
- Attack surface: Web application pages that display affected record fields
- Required access: Permission to create or modify a record field accepted by the vulnerable workflow
- Trigger point: A privileged user opens a page containing the stored value
- Why exploitation is possible: Attacker-controlled data is rendered in an HTML attribute context without appropriate escaping, allowing browser-interpreted markup or script content
- Attack surface: Web application pages that display affected record fields
- Required access: Permission to create or modify a record field accepted by the vulnerable workflow
- Trigger point: A privileged user opens a page containing the stored value
- Why exploitation is possible: Attacker-controlled data is rendered in an HTML attribute context without appropriate escaping, allowing browser-interpreted markup or script content
Why this happens
The vulnerability results from treating record data as trusted presentation content when constructing HTML.
Data inserted into an attribute context must be encoded for that specific context; otherwise, browser parsing can interpret attacker-controlled characters as active markup or script-related content.
This maps to CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting.
The vulnerability results from treating record data as trusted presentation content when constructing HTML.
Data inserted into an attribute context must be encoded for that specific context; otherwise, browser parsing can interpret attacker-controlled characters as active markup or script-related content.
This maps to CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting.
Potential impact
- An attacker may execute script in a privileged user's browser session
- Session information or sensitive page data could be exposed
- Unauthorized actions could be performed with the victim's permissions
- An affected privileged account could be compromised
- Malicious content could be propagated through shared records or pages
- An attacker may execute script in a privileged user's browser session
- Session information or sensitive page data could be exposed
- Unauthorized actions could be performed with the victim's permissions
- An affected privileged account could be compromised
- Malicious content could be propagated through shared records or pages
General mitigation guidance
Mitigation generally focuses on preserving the distinction between data and HTML and applying context-aware output encoding.
Common defensive patterns include:
- HTML-attribute-encode all untrusted values before insertion into attributes
- Prefer safe DOM APIs and templating mechanisms that escape by default
- Validate field content according to business requirements without relying on validation alone
- Apply a restrictive Content Security Policy as defense in depth
- Limit low-privilege users' ability to publish content viewed by privileged users
- Use least-privilege permissions and reduce the sensitivity of privileged browser sessions
Mitigation generally focuses on preserving the distinction between data and HTML and applying context-aware output encoding.
Common defensive patterns include:
- HTML-attribute-encode all untrusted values before insertion into attributes
- Prefer safe DOM APIs and templating mechanisms that escape by default
- Validate field content according to business requirements without relying on validation alone
- Apply a restrictive Content Security Policy as defense in depth
- Limit low-privilege users' ability to publish content viewed by privileged users
- Use least-privilege permissions and reduce the sensitivity of privileged browser sessions
How teams detect issues like this
Organizations can look for stored XSS risks through:
- Static analysis rules identifying string concatenation or interpolation into HTML attributes
- Code review checks for missing context-specific output encoding
- Dynamic testing with inert XSS markers in fields rendered by privileged workflows
- Browser security policy reports and monitoring for unexpected script execution
- Regression tests covering record creation, storage, and privileged-user rendering paths
Automated application-security and code-review tools may help identify unsafe rendering patterns, but findings should be verified against the actual output context.
Organizations can look for stored XSS risks through:
- Static analysis rules identifying string concatenation or interpolation into HTML attributes
- Code review checks for missing context-specific output encoding
- Dynamic testing with inert XSS markers in fields rendered by privileged workflows
- Browser security policy reports and monitoring for unexpected script execution
- Regression tests covering record creation, storage, and privileged-user rendering paths
Automated application-security and code-review tools may help identify unsafe rendering patterns, but findings should be verified against the actual output context.
