XSS vulnerability using crafted filename
Current version of Lutim is vulnerable to an XSS attack.
How to reproduce
- An attacker gives an image with a crafted filename, for example like
<img src=x onerror=alert(0)>.jpg, to a targeted user
- The targeted user uploads the file on Lutim
- The JS payload is executed in the notification after upload and in the
The impact of a successful attack is important because an attacker can read all the images uploaded by the target and can remove them. But succeed in exploiting this attack seems unlikely, because an attacker has to trick the user to use his/her custom filename.
How to fix
Filenames should be escaped in the
myfiles page and in the notifications.