EIQ-2021-0006

EIQ-2021-0006

-

SVG file upload could allow cross-site scripting (XSS)

28 Jan 2021

2 - MEDIUM

CVSSv3 score not available on NIST NVD.

2.9.2

It is possible to manually upload to a workspace an SVG file that can inject malicious JavaScript upon rendering the uploaded file.
This could enable exploiting the vulnerability to carry out a cross-site scripting attack (XSS).

To exploit the vulnerability, a potential attacker would need to:

1. Upload a maliciously crafted SVG file as an attachment to a platform workspace.

2. In the web browser, go to the /private/files/${workspace_id}/media endpoint by copy-pasting it in the web browser address bar.

3. Preview the uploaded SVG in the browser by rendering the preview through the /private/files/${workspace_id}/media endpoint.

By opening the /private/files/${workspace_id}/media endpoint in the web browser tab used to sign in to the platform, the session token is available through the web browser's session storage.
Therefore, embedded JavaScript code in the SVG file can access the token, and use it to send valid requests to the platform API.

A signed-in user without admin access rights could exploit the vulnerability if they have at least the permissions to access and modify workspaces, as well as upload files to workspaces:

• modify blob-uploads

• modify files

• modify workspaces

Proof of concept

Uploading a crafted SVG file with embedded JavaScript such as the one in the example, and then rendering it as a preview through the /private/files/${workspace_id}/media endpoint displays an alert pop-up dialog:

XSS through JavaScript embedded in an SVG file uploaded to a workspace.

This vulnerability is addressed in EclecticIQ Platform 2.10.0 by applying stricter XML sanitization, and by deprecating the /media API endpoint.

2.9.1 and earlier.

n.a.

   This section is not visible to users accessing the public docs, it's for internal reference   

See also:

• TP 48852

• Slack convo in the #engineering-backend channel