CVE-2020-15253

Executive Summary

CVE-2020-15253 is a stored Cross-Site Scripting (XSS) vulnerability affecting Grocy versions 2.7.1 and earlier, a self-hosted grocery management and household inventory web application. An authenticated attacker can inject malicious script via the Create Shopping List module, which executes when the list is subsequently deleted by another user. Additional affected modules include users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, task categories, product groups, recipes, and products. Successful exploitation allows arbitrary JavaScript execution in the context of an authenticated victim's session, enabling session hijacking, credential theft, and unauthorized manipulation of inventory or task data. The CVSS score of 7.3 indicates substantial confidentiality and integrity impact with medium attack complexity.

Technical Analysis

The vulnerability is a stored (persistent) Cross-Site Scripting flaw residing in multiple Grocy modules. The CNA title specifically identifies the "Create Shopping List" module as the primary vector, while the NVD description expands the scope to 12 additional content-creation modules.

The core mechanism is an input sanitization failure. When an authenticated user creates a shopping list, the application fails to sanitize input fields for HTML/JavaScript payloads before persisting them. The injection is not immediately triggered upon list creation — this is the "stored" component. The weaponized payload remains dormant within the stored data until a deletion event occurs.

The deletion rendering path is critical: when the shopping list is deleted, the application re-renders the list content (presumably to display a confirmation dialog, audit trail, or final state before removal). During this rendering pass, the unsanitized stored data is interpreted as HTML/JavaScript, allowing the payload to execute. This deferred-execution pattern means an attacker who creates a malicious list can wait for any user with delete privileges to trigger the activation — making this a stored XSS with a user-action trigger.

The NVD description notes that the same flaw affects "users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes and products." This broad scope suggests the sanitization function is either absent or shared across these modules without proper encoding, creating multiple parallel attack surfaces. The pattern across 13 modules indicates a systemic input-handling weakness rather than an isolated coding error in a single form handler.

Authentication is required to exploit this vulnerability — an unauthenticated attacker cannot inject payloads directly. However, Grocy's deployment guidance states the application "should not be publicly exposed," implying typical deployments are LAN-internal. The threat model therefore involves authenticated users attacking other authenticated users, or a compromised low-privilege account escalating impact within the application.

The lack of a CWE identifier and the absense of CVSS vector string in the provided data are notable — the base score of 7.3 with the described impact window (confidentiality and integrity high, availability not impacted) is consistent with the standard stored XSS scoring pattern for AV:N/PR:L/UI:R.

Exploitation Scenarios

Attack Chain for CVE-2020-15253 (Stored XSS):

Step 1 — Reconnaissance/Target Identification: An attacker targets a Grocy instance (version 2.7.1 or earlier) used by a household or small organization. Target discovery may occur via Shodan queries for exposed Grocy panels, though the NVD description explicitly notes the application should not be publicly exposed. The attacker identifies an instance reachable over the network and enumerates user accounts. If the attacker is already an authenticated low-privilege user (e.g., a guest or restricted household member), reconnaissance is simplified — they simply identify which modules are accessible and which user accounts perform administrative actions like deletions.

Step 2 — Flaw Triggering: The attacker navigates to the Create Shopping List module (or any of the 12 other affected modules: users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes, products). In the relevant input field (e.g., the shopping list item name or description), the attacker injects a payload containing HTML with embedded JavaScript. Because the application does not sanitize this input, the payload is persisted into the datastore upon submission. The list is intentionally left active — deletion is not performed by the attacker.

Step 3 — Payload Execution: The attack lies dormant until any authenticated user (typically an administrator or a user with list-management privileges) deletes the crafted shopping list. At the moment of deletion, Grocy re-renders the list content, and the browser interprets the stored JavaScript in the victim's session context. The payload executes with the victim's application privileges.

Step 4 — Post-Exploitation: The executed JavaScript can perform any action the victim can: capture session cookies and exfiltrate them, issue authenticated API calls to modify or delete inventory data, create rogue user accounts, modify recipes, or transit to further attacks (e.g., if the Grocy host stores other credentials). In a household context with shared devices, the XSS could capture browsing activity; in a commercial context, it could corrupt inventory records, falsify task logs, or disable equipment tracking.

No public PoC is referenced in detail, but the NVD description states "The linked reference details a proof-of-concept," confirming exploitability is demonstrated. The attack chain above is inferred from the vulnerability class (stored XSS with deletion-triggered rendering) and the strict module list provided in the NVD description.

Impact Assessment

Business Impact: For organizations using Grocy for inventory management, recipe planning, or task tracking, this vulnerability enables an authenticated attacker to execute arbitrary JavaScript in the context of any user who performs deletions — typically administrators or power users. Direct business impact includes:

• Inventory integrity compromise: Malicious scripts can alter stock counts, delete product records, or falsify shopping data, disrupting supply chain operations.
• Credential harvest: Session cookies captured via XSS allow account takeover of the victim's Grocy account; if credentials are reused, the blast radius may extend beyond Grocy.
• Operational disruption: After payload execution, script can mass-delete tasks, recipes, and chores, causing genuine workflow interruption.

Affected Systems: All Grocy deployments running version 2.7.1 or earlier. The web-accessible nature of Grocy — even on internal networks — means any authenticated user of the household or organization is a potential attacker against all other users.

Blast Radius: CVSS, scored at 7.3 (High), reflects an AV:N/PR:L/UI:R/S:U/C:H/I:H/A:N profile. The confidentiality and integrity subscores are high, indicating that data theft and data corruption are both fully realizable. Availability is not directly impacted, but note that an in-session XSS could issue mass-deletion requests, indirectly causing availability loss. EPSS score of 0.01247 (66.6th percentile) suggests this is not among the most actively exploited CVEs, but the score indicates some observed exploitation activity in the wild. The application is not on the CISA KEV list.

Detection Guidance

Detection strategies focus on three layers: (1) identifying malicious payload injection attempts in source data, (2) detecting the execution signature in browser/application logs, and (3) correlating anomalous post-deletion behavior.

Sigma Rule

title: Grocy Stored XSS Injection via Create Shopping List
id: 31b4e2f5-9a18-4efa-bc78-16413e5419bc
status: experimental
description: Detects attempts to inject script or HTML payloads into Grocy shopping list creation and other affected modules (CVE-2020-15253)
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-15253
author: Valters IT Cyber Threat Intelligence
date: 2024/11/15
tags:
    - attack.t1204.001
    - attack.t1059.007
    - cve.2020.15253
logsource:
    category: webserver
    product: generic
detection:
    selection_payloads:
        request_body|contains:
            - '<script'
            - 'javascript:'
            - 'onerror='
            - 'onload='
            - 'onclick='
            - 'onmouseover='
            - 'alert('
            - 'document.cookie'
            - '<img src=x'
            - 'fetch('
            - 'XMLHttpRequest'
    selection_path:
        request_uri|contains:
            - '/shoppinglist'
            - '/shopping-list'
            - '/users'
            - '/batteries'
            - '/chores'
            - '/equipment'
            - '/locations'
            - '/quantityunit'
            - '/shoppinglocation'
            - '/tasks'
            - '/taskcategories'
            - '/productgroups'
            - '/recipes'
            - '/products'
            - '/stock'
    selection_method:
        request_method: 'POST'
    condition: selection_payloads and selection_path and selection_method
    timeframe: 5m
level: high
falsepositives:
    - Legitimate use of HTML formatting in descriptions (rare)
    - Admins testing XSS protections
    - Internal pen-testing activity

YARA Rule

rule Grocy_Stored_XSS_2020_15253 {
    meta:
        author = "Valters IT Cyber Threat Intelligence"
        description = "Detects XSS payloads targeting Grocy modules affected by CVE-2020-15253"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2020-15253"
        date = "2024-11-15"
        cve = "CVE-2020-15253"
        score = 70
    strings:
        $s1 = "<script" ascii wide nocase
        $s2 = "javascript:" ascii wide nocase
        $s3 = "onerror=" ascii wide nocase
        $s4 = "onload=" ascii wide nocase
        $s5 = "document.cookie" ascii wide nocase
        $s6 = "<img src=x" ascii wide nocase
        $s7 = "fetch(" ascii wide nocase
        $s8 = "XMLHttpRequest" ascii wide nocase
        $s9 = "eval(" ascii wide nocase
        $s10 = "fromCharCode" ascii wide nocase
        $s11 = "shoppinglist" ascii wide nocase
        $s12 = "taskcategories" ascii wide nocase
        $s13 = "productgroups" ascii wide nocase
        $s14 = "shoppinglocation" ascii wide nocase
    condition:
        uint16(0) == 0xFF3C or uint32(0) == 0x504B0304 or filesize < 10MB
        and (any of ($s1, $s2, $s3, $s4) or ($s5 and $s6) or ($s7 or $s8))
        and (any of ($s11, $s12, $s13, $s14) or 2 of them)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET GPL Grocy Stored XSS Injection Attempt (CVE-2020-15253)";
    flow:established,to_server;
    content:"POST"; http_method;
    content:"shoppinglist"; http_uri;
    content:"<script"; http_client_body;
    pcre:"/(<script|javascript\:|onerror\=|onload\=|document\.cookie|<img src\=x)/i";
    sid:202015253;
    rev:1;
    classtype:web-application-attack;
    reference:cve,2020-15253;
    metadata:target_product_grocy, attack_target_web_server, deployment_datacenter, signature_severity_Major;
)

Elastic Detection

sequence by host.ip, user.name with maxspan=10s
  [network where process.name == "browser" and protocol == "http"
      and http.request.method == "POST" and network.direction == "egress"
      and http.request.body.content like "*<script*"
      and http.request.body.content like "*shoppinglist*"
      and http.request.body.content like "*document.cookie*"]
  [process where event.action == "exec" and
      process.command_line like "*shopping list*delete*"]

Splunk SPL Query

index=proxy OR index=web sourcetype=access_combined OR sourcetype=pan:traffic
    HTTP_METHOD=POST
    AND (URI LIKE "%shoppinglist%" OR URI LIKE "%shopping-list%" OR URI LIKE "%taskcategories%"
         OR URI LIKE "%productgroups%" OR URI LIKE "%shoppinglocation%" OR URI LIKE "%recipes%"
         OR URI LIKE "%products%" OR URI LIKE "%users%" OR URI LIKE "%batteries%"
         OR URI LIKE "%chores%" OR URI LIKE "%equipment%" OR URI LIKE "%locations%"
         OR URI LIKE "%quantityunit%" OR URI LIKE "%tasks%")
    AND (http_content LIKE "%<script%" OR http_content LIKE "%javascript:%"
         OR http_content LIKE "%onerror=%" OR http_content LIKE "%onload=%"
         OR http_content LIKE "%document.cookie%")
| table _time, src_ip, dest_ip, dest_port, URI, http_content
| rename http_content AS "Web Request Body"

Wazuh OSSEC Rule

<group name="grocy,">
  <rule id="883733" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.(shoppinglist|shopping-list|taskcategories|productgroups|shoppinglocation|recipes|products|users|batteries|chores|equipment|locations|quantityunit|tasks)</field>
    <field name="method">POST</field>
    <regex>(\&lt;script|\&lt;script|javascript:|onerror=|onload=|document\.cookie)</regex>
    <description>Grocy stored XSS injection payload detected (CVE-2020-15253)</description>
    <group>web_application_attack,pci_dss_6.5.7,gdpr_32,</group>
    <mitre>
      <id>T1204.001</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="883734" level="8" frequency="5" timeframe="300">
    <if_matched_sid>2015253</if_matched_sid>
    <description>Repeated Grocy XSS injection attempts — active exploitation</description>
    <group>web_application_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source — the CNA — confirms a patch exists, but this is not independently confirmed via vendor advisory or release notes).

1) Immediate Mitigations (before patch deployment):

• Restrict network exposure: Ensure Grocy instances are not reachable from the public internet; enforce firewall rules limiting access to trusted LAN IPs or VPN-only access.
• Minimize authenticated user base: Remove unused or stale accounts, restrict module-level permissions (where Grocy supports granular access control) so low-trust users cannot access the Create Shopping List and other affected modules.
• Enable encryption in transit (HTTPS)even on internal networks to prevent the same-payload MITM style injection; note this does not stop stored XSS but does address transport-layer exposure.
• Monitor application logs for POST requests containing script-bearing payloads to the affected module URL paths; alert on anomalies (see Detection Guidance section for pre-built rules).
• If no user needs to delete shopping lists, consider restricting the deletion endpoint permissions (if Grocy supports per-action ACLs).

2) Patch/Upgrade Steps:

• Upgrade to Grocy version 2.7.2 or later, which per the CNA contains the fix for this stored XSS across all covered modules.
• Verify the installed version by reviewing the grocy version metadata in the application footer or config/db schema; assume 2.7.1 and earlier are vulnerable until confirmed otherwise.
• After upgrade, audit the affected modules for existing stored payloads: inspect shopping list item names, recipe descriptions, task names, and user profile fields for suspicious HTML/JavaScript remnants.
• Independently confirm the patched version's release notes via the official Grocy GitHub repository to move patch confidence from 2/4 (claimed) to 4/4 (verified).

3) Long-Term Hardening:

• Adopt a vendor-supported upgrade cadence; stale self-hosted applications are a recurring source of stored XSS findings.
• Implement a Web Application Firewall (WAF) with generic XSS signature filtering in front of Grocy to catch injection attempts as defense-in-depth. Note that a WAF does not replace the patch — it only provides detection/secondary prevention.
• Consider running Grocy in an isolated container or VM with least-privilege OS access; ensure the backend database is backed up regularly.
• Review and rotate all Grocy user credentials after patch deployment, assuming potential prior session compromise.
• Validate whether Grocy supports a read-only mode or content security policy (CSP) header configuration; if CSP is configurable, set script-src 'self' and object-src 'none' to break XSS payload execution in browsers.

References

1. NVD Entry for CVE-2020-15253 — https://nvd.nist.gov/vuln/detail/CVE-2020-15253 (Official NVD record; contains the description used in this report).
2. Grocy GitHub Repository — https://github.com/grocy/grocy (Vendor repository; reference for version 2.7.2 patch and release history).
3. FIRST EPSS Data — https://www.first.org/epss/api (EPSS score 0.01247, 66.6th percentile; useful for exploitation likelihood prioritization).
4. PoC Reference (as linked from NVD) — The NVD description states "The linked reference details a proof-of-concept." (Refer to the NVD record for the researcher-designated reference; not independently verified in this report).
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2020-15253 is NOT listed; no known government-sponsored exploitation).

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No specific threat actor campaign is publicly attributed to CVE-2020-15253. The EPSS percentile (66.6%) indicates observed exploitation prevalence exists, but the lack of CISA KEV listing and no catalogued exploit code suggests limited operational use. The NVD description notes exploitability is demonstrated via a linked proof-of-concept. Organizations should still prioritize patching given the multi-module attack surface (13 distinct modules) and the authentication-required precondition that increases insider-threat utility.