Summary
Frappe ERPNext contains a stored cross-site scripting vulnerability because some record names are not properly neutralized before being rendered in dashboards, tools, and portals. An authenticated attacker who can create or rename relevant records may cause scripts to execute in other users' browsers, potentially exposing data or session tokens.
Frappe ERPNext contains a stored cross-site scripting vulnerability because some record names are not properly neutralized before being rendered in dashboards, tools, and portals. An authenticated attacker who can create or rename relevant records may cause scripts to execute in other users' browsers, potentially exposing data or session tokens.
Affected context
The issue may affect ERPNext deployments using versions before 15.103.0 or certain 16.x releases before 16.12.0, where record names are displayed in dashboards, tools, or portals without adequate output encoding. Risk depends on whether an authenticated user can influence record names and whether those names are subsequently viewed by other users, particularly privileged users.
The issue may affect ERPNext deployments using versions before 15.103.0 or certain 16.x releases before 16.12.0, where record names are displayed in dashboards, tools, or portals without adequate output encoding. Risk depends on whether an authenticated user can influence record names and whether those names are subsequently viewed by other users, particularly privileged users.
Exploit preconditions
- Attack surface: ERPNext dashboards, tools, or portal views that render user-controlled record names
- Required access: Authenticated access sufficient to create or modify affected records
- Trigger point: Another user views a page that displays the maliciously named record
- Why exploitation is possible: Record names are stored and later rendered without context-appropriate neutralization, allowing browser-interpreted content to reach other users
- Attack surface: ERPNext dashboards, tools, or portal views that render user-controlled record names
- Required access: Authenticated access sufficient to create or modify affected records
- Trigger point: Another user views a page that displays the maliciously named record
- Why exploitation is possible: Record names are stored and later rendered without context-appropriate neutralization, allowing browser-interpreted content to reach other users
Why this happens
The underlying flaw is insufficient output encoding for attacker-controlled record names in HTML-rendering contexts. Data that should remain inert is inserted into pages without applying the escaping required by the relevant output context, allowing the browser to interpret it as active script. This behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), specifically a stored XSS pattern.
The underlying flaw is insufficient output encoding for attacker-controlled record names in HTML-rendering contexts. Data that should remain inert is inserted into pages without applying the escaping required by the relevant output context, allowing the browser to interpret it as active script. This behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), specifically a stored XSS pattern.
Potential impact
- An attacker may access data visible to the targeted user's browser session
- Scripts could modify records or perform actions with the victim's privileges
- Session information or exposed tokens could be disclosed
- Privileged users' accounts could be targeted for broader administrative impact
- Users may be redirected to attacker-controlled content or shown deceptive interface elements
- An attacker may access data visible to the targeted user's browser session
- Scripts could modify records or perform actions with the victim's privileges
- Session information or exposed tokens could be disclosed
- Privileged users' accounts could be targeted for broader administrative impact
- Users may be redirected to attacker-controlled content or shown deceptive interface elements
General mitigation guidance
Mitigation generally focuses on consistent, context-aware output encoding and reducing trust in record names throughout the rendering pipeline.
Common defensive patterns include:
- Encode untrusted values for the exact HTML, attribute, URL, or JavaScript context in which they are rendered
- Prefer framework templating features that escape output by default
- Avoid inserting record names into executable or interpreter-sensitive contexts
- Apply server-side validation as a secondary control, without treating validation as a replacement for output encoding
- Use restrictive Content Security Policy controls where practical
- Limit privileged browser sessions and apply least privilege to user roles
- Treat stored record fields as untrusted even when created by authenticated users
Mitigation generally focuses on consistent, context-aware output encoding and reducing trust in record names throughout the rendering pipeline.
Common defensive patterns include:
- Encode untrusted values for the exact HTML, attribute, URL, or JavaScript context in which they are rendered
- Prefer framework templating features that escape output by default
- Avoid inserting record names into executable or interpreter-sensitive contexts
- Apply server-side validation as a secondary control, without treating validation as a replacement for output encoding
- Use restrictive Content Security Policy controls where practical
- Limit privileged browser sessions and apply least privilege to user roles
- Treat stored record fields as untrusted even when created by authenticated users
How teams detect issues like this
Organizations can look for stored XSS risks through:
- Static analysis rules identifying unescaped template variables and unsafe HTML insertion
- Code review checks for record fields rendered in dashboards, portals, and administrative tools
- Dynamic testing with inert markers in fields that are later displayed across user roles
- Regression tests covering HTML, attribute, URL, and script-related rendering contexts
- Web application monitoring for unexpected script execution or unusual browser-originated actions
- Policy enforcement requiring auto-escaping templates and security review for explicitly trusted HTML
Automated code review and SAST tools may help identify unsafe rendering patterns, but findings should be validated against the actual output context.
Organizations can look for stored XSS risks through:
- Static analysis rules identifying unescaped template variables and unsafe HTML insertion
- Code review checks for record fields rendered in dashboards, portals, and administrative tools
- Dynamic testing with inert markers in fields that are later displayed across user roles
- Regression tests covering HTML, attribute, URL, and script-related rendering contexts
- Web application monitoring for unexpected script execution or unusual browser-originated actions
- Policy enforcement requiring auto-escaping templates and security review for explicitly trusted HTML
Automated code review and SAST tools may help identify unsafe rendering patterns, but findings should be validated against the actual output context.
