Multiple possible admin XSS vulnerabilities

[John Hawthorn]

Multiple possible admin XSS vulnerabilities

Versions Affected: All versions of Spree and Solidus
Not affected: None.
Fixed Versions: Solidus 1.0.5, 1.1.3, 1.2.1
Severity: Medium

Impact
------
Several vulnerabilities allow one admin user to inject HTML into various pages
on the admin. This can lead to privilege escalation if the site is configured
with multiple different admin roles. This would also be exploitable if an
attacker had the ability to name products, variants, option types, or option
values.

The vulnerability exists both through use of select2 formatters without
escaping as well as misuse of .html_safe and raw().

Additionally, some of the helpers in the admin, button_link_to and
link_to_with_icon, did not escape input as one would expect if they were
following the standard rails conventions. If the text argument of these helpers
contained user input, an attacker would be able to inject HTML onto the page.
This is not exploitable by default in the admin, as no user input is provided
to these methods, but could be exploitable due to admin customizations.


Releases
--------
The fixed releases are available on rubygems as well as in the github branches

Workarounds
-----------

Protecting against a malicious admin user requires several changes, and
we aren't able to provide a suitable workaround.

If you are unable to upgrade or apply these patches, and do not have separate
admin roles, audit your use of text_for_button_link, button_link_to, and
link_to_with_icon to ensure they are never passed user input (including any
values saved to the database).


--
John Hawthorn