EC-CUBE, an open-source e-commerce platform, contains an actively exploited cross-site…
EC-CUBE, an open-source e-commerce platform, contains an actively exploited cross-site scripting vulnerability allowing attackers to execute scripts in administrator browsers.
Japan's IPA has issued an advisory regarding a cross-site scripting (XSS) vulnerability in EC-CUBE, an open-source shopping site construction system developed by EC-CUBE Co., Ltd. The vulnerability exists in the administrative interface and allows attackers to inject malicious scripts through specific input fields. When administrators perform certain operations, arbitrary scripts can be executed in their browsers.
The vulnerability has a CVSS v3 score of 7.1 (high severity) and CVSS v2 score of 6.8. According to the developer, active exploitation of this vulnerability has been confirmed in the wild, making immediate patching critical. The attack vector requires an attacker to input malicious scripts into specific fields on EC sites created with the vulnerable platform, which then execute when site administrators interact with the affected functionality.
The developer has released updated versions and hotfix patches to address this vulnerability. Organizations running EC-CUBE are urged to apply updates or patches as soon as possible given the confirmed exploitation activity. The advisory was published by IPA's Security Center on May 10, 2021.
Mentioned in this report
Detection guidance
Possible XSS Payload Injection Attempt in Web Request Parameters (EC-CUBE Admin)
Detects HTTP requests containing common script-injection patterns in URI query strings or POST body fields, consistent with stored XSS attempts against EC-CUBE admin input fields. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible XSS Payload Injection Attempt in Web Request Parameters
id: 95edbbeb-9afd-56ab-8961-5525d662e91a
status: experimental
description: 'Detects web requests where the URI query string or request body contains
script-tag or event-handler based XSS payload patterns. This behaviour
matches attempts to store malicious JavaScript in application input fields
(e.g. product/administrative fields in EC-CUBE) that later execute in an
administrator''s browser when the record is viewed or edited.
'
references:
- https://www.ipa.go.jp/security/
author: Vorant
tags:
- attack.t1059.007
- attack.t1189
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- onmouseover=
- document.cookie
filter_common_false:
cs-uri-query|contains:
- utm_source
condition: selection and not filter_common_false
falsepositives:
- Legitimate product descriptions or CMS content that legitimately contains the string
"script" as part of marketing copy
- Security scanners or penetration testing tools probing the application for XSS as
part of authorized testing
- Web analytics or tag-manager scripts intentionally embedding inline JavaScript in
query parameters
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20210510-jvn.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free