Description
LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
abhinavxd libredesk
Default version status: unaffected
0 to < 2.9.0-rc.8affected
pkg:github/abhinavxd/libredeskReferences
- https://github.com/abhinavxd/libredesk/pull/641 ↗
- https://github.com/abhinavxd/libredesk/commit/ab3a5ca682fcc1caec0950fc607b66caea49bec3 ↗
- https://github.com/abhinavxd/libredesk/blob/086b08200d667f2cc083635e925d6f5e7b0097e3/cmd/media.go#L255-L272 ↗
- https://github.com/abhinavxd/libredesk/blob/086b08200d667f2cc083635e925d6f5e7b0097e3/internal/media/media.go#L422-L433 ↗
- https://github.com/abhinavxd/libredesk/releases/tag/v2.9.0-rc.8 ↗
- https://github.com/abhinavxd/libredesk ↗
- https://www.vulncheck.com/advisories/libredesk-before-2.9.0-rc.8-stored-xss-via-svg-upload-content-type-parameter ↗