Summary
Shopper allows certain authenticated back-office staff to upload HTML or SVG media that may be served inline from the administrator's origin. If an administrator opens a malicious uploaded file, stored script could execute in the administrator's session and potentially create an attacker-controlled administrator account, access sensitive data, or change permissions.
Shopper allows certain authenticated back-office staff to upload HTML or SVG media that may be served inline from the administrator's origin. If an administrator opens a malicious uploaded file, stored script could execute in the administrator's session and potentially create an attacker-controlled administrator account, access sensitive data, or change permissions.
Affected context
The issue can arise in Shopper deployments where staff with content-upload permissions can store executable media and those files are served inline from the application's origin. Relevant conditions include permissive MIME validation, product-file uploads that accept executable content, and responses that lack download disposition or browser-side content isolation. The risk is especially significant when an administrator views an uploaded file while authenticated.
The issue can arise in Shopper deployments where staff with content-upload permissions can store executable media and those files are served inline from the application's origin. Relevant conditions include permissive MIME validation, product-file uploads that accept executable content, and responses that lack download disposition or browser-side content isolation. The risk is especially significant when an administrator views an uploaded file while authenticated.
Exploit preconditions
- Attack surface: Authenticated back-office media and product-file upload functionality
- Required access: A staff account with an applicable content-upload permission, such as product or brand editing access
- Trigger point: An administrator opens the uploaded HTML or SVG file from the application's origin
- Why exploitation is possible: Executable content is stored and returned inline with its own content type, allowing script to run in the viewing administrator's session
- Additional condition: The administrator must open the file; direct account creation by the uploader is not required or necessarily available
- Attack surface: Authenticated back-office media and product-file upload functionality
- Required access: A staff account with an applicable content-upload permission, such as product or brand editing access
- Trigger point: An administrator opens the uploaded HTML or SVG file from the application's origin
- Why exploitation is possible: Executable content is stored and returned inline with its own content type, allowing script to run in the viewing administrator's session
- Additional condition: The administrator must open the file; direct account creation by the uploader is not required or necessarily available
Why this happens
The vulnerability results from treating user-uploaded media as passive content while allowing formats that can contain executable browser scripts. Files are served inline from the administrator's origin without sufficient content isolation, such as attachment handling or an appropriate Content Security Policy.
This maps primarily to CWE-79: Improper Neutralization of Input During Web Page Generation, because attacker-controlled content is rendered in a trusted web origin and executes in a privileged user's browser context. The resulting administrative account creation or permission abuse also relates to CWE-269: Improper Privilege Management, where client-controlled role data may influence a privileged account-management operation.
The vulnerability results from treating user-uploaded media as passive content while allowing formats that can contain executable browser scripts. Files are served inline from the administrator's origin without sufficient content isolation, such as attachment handling or an appropriate Content Security Policy.
This maps primarily to CWE-79: Improper Neutralization of Input During Web Page Generation, because attacker-controlled content is rendered in a trusted web origin and executes in a privileged user's browser context. The resulting administrative account creation or permission abuse also relates to CWE-269: Improper Privilege Management, where client-controlled role data may influence a privileged account-management operation.
Potential impact
- An attacker may execute JavaScript in an administrator's authenticated session.
- An attacker could create a persistent administrator account with attacker-selected credentials.
- Sensitive customer, order, configuration, or user data could be accessed or exfiltrated.
- Administrative roles or permissions could be changed.
- The application could be modified, disrupted, or used for further compromise.
- An attacker may execute JavaScript in an administrator's authenticated session.
- An attacker could create a persistent administrator account with attacker-selected credentials.
- Sensitive customer, order, configuration, or user data could be accessed or exfiltrated.
- Administrative roles or permissions could be changed.
- The application could be modified, disrupted, or used for further compromise.
General mitigation guidance
Mitigation generally focuses on separating uploaded content from trusted administrative origins and preventing executable media from being accepted or interpreted.
Common defensive patterns include:
- Allowing only the minimal image and document formats required by each upload field.
- Rejecting SVG, HTML, and other script-capable formats when they are not essential.
- Serving untrusted files from an isolated origin or through a controlled download path.
- Applying
Content-Disposition: attachmentand restrictive content types where inline rendering is unnecessary. - Enforcing a restrictive Content Security Policy for media and administrative pages.
- Validating MIME type, file signature, extension, and content against an allowlist on the server.
- Avoiding client-supplied role or privilege values in account-management operations and deriving authorization from server-side policy.
- Applying least privilege to uploaders and administrators, with explicit authorization checks for role assignment.
- Preserving uploaded-content isolation even after files are renamed, transformed, or moved.
Mitigation generally focuses on separating uploaded content from trusted administrative origins and preventing executable media from being accepted or interpreted.
Common defensive patterns include:
- Allowing only the minimal image and document formats required by each upload field.
- Rejecting SVG, HTML, and other script-capable formats when they are not essential.
- Serving untrusted files from an isolated origin or through a controlled download path.
- Applying
Content-Disposition: attachmentand restrictive content types where inline rendering is unnecessary. - Enforcing a restrictive Content Security Policy for media and administrative pages.
- Validating MIME type, file signature, extension, and content against an allowlist on the server.
- Avoiding client-supplied role or privilege values in account-management operations and deriving authorization from server-side policy.
- Applying least privilege to uploaders and administrators, with explicit authorization checks for role assignment.
- Preserving uploaded-content isolation even after files are renamed, transformed, or moved.
How teams detect issues like this
Detection can combine application testing, source review, and policy controls.
- Use static analysis to identify upload handlers that allow HTML, SVG, or other active formats.
- Review media response paths for inline serving, user-controlled content types, missing download disposition, and absent or weak Content Security Policy headers.
- Inspect authorization logic for client-controlled role identifiers or privilege parameters.
- Test whether uploaded content is rendered under the same origin as authenticated administrative functions.
- Monitor administrative account creation, role changes, and permission grants associated with unusual upload activity or newly created accounts.
- Enforce CI policies that require explicit allowlists and security review for executable or browser-interpreted upload formats.
- Automated application-security review tools may help identify stored XSS sinks and unsafe upload configurations.
Detection can combine application testing, source review, and policy controls.
- Use static analysis to identify upload handlers that allow HTML, SVG, or other active formats.
- Review media response paths for inline serving, user-controlled content types, missing download disposition, and absent or weak Content Security Policy headers.
- Inspect authorization logic for client-controlled role identifiers or privilege parameters.
- Test whether uploaded content is rendered under the same origin as authenticated administrative functions.
- Monitor administrative account creation, role changes, and permission grants associated with unusual upload activity or newly created accounts.
- Enforce CI policies that require explicit allowlists and security review for executable or browser-interpreted upload formats.
- Automated application-security review tools may help identify stored XSS sinks and unsafe upload configurations.
