CVE-2021-33351
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in the Wyomind Help Desk Magento 2 extension that allows attackers to inject malicious scripts into ticket messages. When exploited, it enables privilege escalation by executing arbitrary code in the context of other users' sessions. Affected users are those running Magento 2 with the vulnerable Wyomind Help Desk extension.
💻 Affected Systems
- Wyomind Help Desk Magento 2 extension
📦 What is this software?
Help Desk by Wyomind
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative privileges, compromise the entire Magento store, steal customer data, and install backdoors.
Likely Case
Attackers escalate privileges to gain unauthorized access to administrative functions, potentially modifying orders or accessing sensitive data.
If Mitigated
With proper input validation and output encoding, the attack would be prevented, maintaining normal system functionality.
🎯 Exploit Status
Exploitation requires access to create or modify ticket messages, typically requiring at least low-privilege user access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.3.7
Vendor Advisory: https://www.wyomind.com/magento2/helpdesk-magento-2.html
Restart Required: No
Instructions:
1. Log into Magento admin panel. 2. Navigate to System > Web Setup Wizard > Extension Manager. 3. Search for Wyomind Help Desk. 4. Update to version 1.3.7 or later. 5. Clear Magento cache via System > Cache Management.
🔧 Temporary Workarounds
Disable Help Desk Extension
linuxTemporarily disable the vulnerable extension until patching is possible.
php bin/magento module:disable Wyomind_Helpdesk
php bin/magento setup:upgrade
php bin/magento cache:flush
Implement Input Validation
allAdd custom input validation to sanitize ticket message fields.
Edit extension files to add HTML entity encoding for user input in ticket processing
🧯 If You Can't Patch
- Restrict user permissions to minimize who can create or edit tickets.
- Implement web application firewall (WAF) rules to block XSS payloads in ticket submissions.
🔍 How to Verify
Check if Vulnerable:
Check the extension version in Magento admin under Stores > Configuration > Advanced > Advanced. Look for Wyomind_Helpdesk module version.Check Version:
php bin/magento module:status | grep Wyomind_HelpdeskVerify Fix Applied:
Confirm the extension version is 1.3.7 or higher and test ticket creation with XSS payloads to ensure they are sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual ticket creation/modification patterns
- JavaScript or HTML payloads in ticket message fields in application logs
Network Indicators:
- HTTP POST requests to ticket endpoints containing script tags or JavaScript code
SIEM Query:
source="magento_logs" AND ("ticket" AND ("<script>" OR "javascript:" OR "onerror="))