Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

Summary

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related coupons, stealing CSRF tokens to create administrator accounts.

Remediation

1. Inventory every Thelia Thelia deployment, including staging.
2. Upgrade Thelia Thelia to 3.1.0.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/thelia/thelia/commit/c90d59375089a0833a56703c6f9f9ddea17bddc9
• Advisoryhttps://github.com/thelia/thelia/security/advisories/GHSA-r63g-6wfg-v5v9
• Advisoryhttps://www.vulncheck.com/advisories/thelia-before-3.1.0-stored-xss-via-coupon-condition-customer-name
• Referencehttps://github.com/thelia/thelia/releases/tag/3.1.0
• Referencehttps://github.com/thelia/thelia/blob/3.0.0/core/lib/Thelia/Condition/Implementation/ForSomeCustomers.php#L119