XSS vulnerability in select2 in the admin

[John Hawthorn]

XSS vulnerability in select2 in the admin

Versions Affected: All versions of Spree and Solidus
Not affected: None.
Fixed Versions: Solidus 1.0.5, 1.1.3, 1.2.1
Severity: High

Impact
------
An attacker can potentially inject html into the admin by registering with a
specially crafted email. This could lead to injecting javascript into the admin
and stealing the admin's API key and other credentials.

This vulnerability is exposed in two places in the admin:

On the "Customer Details" page of the admin the vulnerability is triggered by
selecting the malicious user from the dropdown.

In the Promotions section of the admin. This can be triggered by adding a
"User" rule and starting a search. This would also be the case for anywhere
userAutocomplete was used in the admin javascript.

This vulnerability exists because custom formatting options were provided to
select2 which did not escape html.

All users should upgrade immediately.


Releases
--------
The fixed releases are available on rubygems as well as in the github branches

These releases have been patched so that the select2 boxes properly escape
user emails.

Workarounds
-----------
Though upgrading or patching is recommended, this can be worked around by
adding stricter validation on the email address. This is a different
approach than the patch,


# config/initializers/2016-02-22-security-user-email-xss.rb
# Ensure emails cannot contain HTML.
Spree::User.class_eval do
validates :email, format: { with: /\A[^<>]+\z/ }
end


This does have the downside of possibly having validations show up as:

Email is invalid
Email is invalid

--
John Hawthorn