EC-CUBE fixes actively exploited administrator cross-site scripting flaw
EC-CUBE, an open-source e-commerce platform, contains an actively exploited cross-site scripting vulnerability allowing attackers to execute scripts in administrator browsers.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Japan's IPA has issued an advisory regarding a cross-site scripting (XSS) vulnerability in EC-CUBE, an open-source shopping site construction system developed by EC-CUBE Co., Ltd. The vulnerability exists in the administrative interface and allows attackers to inject malicious scripts through specific input fields. When administrators perform certain operations, arbitrary scripts can be executed in their browsers.
The vulnerability has a CVSS v3 score of 7.1 (high severity) and CVSS v2 score of 6.8. According to the developer, active exploitation of this vulnerability has been confirmed in the wild, making immediate patching critical. The attack vector requires an attacker to input malicious scripts into specific fields on EC sites created with the vulnerable platform, which then execute when site administrators interact with the affected functionality.
The developer has released updated versions and hotfix patches to address this vulnerability. Organizations running EC-CUBE are urged to apply updates or patches as soon as possible given the confirmed exploitation activity. The advisory was published by IPA's Security Center on May 10, 2021.
Mentioned in this report
Detection guidance
Possible XSS Payload Injection Attempt in Web Request Parameters (EC-CUBE Admin)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests containing common script-injection patterns in URI query strings or POST body fields, consistent with stored XSS attempts against EC-CUBE admin input fields. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible XSS Payload Injection Attempt in Web Request Parameters
id: 95edbbeb-9afd-56ab-8961-5525d662e91a
status: experimental
description: 'Detects web requests where the URI query string or request body contains
script-tag or event-handler based XSS payload patterns. This behaviour
matches attempts to store malicious JavaScript in application input fields
(e.g. product/administrative fields in EC-CUBE) that later execute in an
administrator''s browser when the record is viewed or edited.
'
references:
- https://www.ipa.go.jp/security/
author: Vorant
tags:
- attack.t1059.007
- attack.t1189
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- onmouseover=
- document.cookie
filter_common_false:
cs-uri-query|contains:
- utm_source
condition: selection and not filter_common_false
falsepositives:
- Legitimate product descriptions or CMS content that legitimately contains the string
"script" as part of marketing copy
- Security scanners or penetration testing tools probing the application for XSS as
part of authorized testing
- Web analytics or tag-manager scripts intentionally embedding inline JavaScript in
query parameters
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20210510-jvn.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs