Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1mbTUzLW1wbXAtN3F3Ms4AArNK

Possible cross-site scripting attack via unsanitized SVG files in FoF Upload

Impact

If FoF Upload is configured to allow the uploading of SVG files (image/svg+xml), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker.

This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously.

Patches

This has been patched with v1.2.3, which now sanitizes uploaded SVG files.

Workarounds

Upgrade to 1.2.3 (requires Flarum 1.2 or later), or remove the ability for users to upload SVG files through FoF Upload.

References

Thank you to Safwat Refaat for the responsible disclosure of this vulnerability.

Permalink: https://github.com/advisories/GHSA-fm53-mpmp-7qw2
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mbTUzLW1wbXAtN3F3Ms4AArNK
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago

CVSS Score: 8.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Identifiers: GHSA-fm53-mpmp-7qw2, CVE-2022-30999
References:

• https://github.com/FriendsOfFlarum/upload/security/advisories/GHSA-fm53-mpmp-7qw2
• https://nvd.nist.gov/vuln/detail/CVE-2022-30999
• https://github.com/FriendsOfFlarum/upload/issues/68
• https://github.com/FriendsOfFlarum/upload/pull/318
• https://github.com/FriendsOfFlarum/upload/releases/tag/1.2.3
• https://github.com/advisories/GHSA-fm53-mpmp-7qw2

Repository: https://github.com/FriendsOfFlarum/upload
Blast Radius: 12.2

Affected Packages