Stored XSS due to the setting text/xml mime type for xml files in neorazorx/facturascripts

Valid

Reported on

May 11th 2022


Description

Hi, The patch for the previous XSS vulnerability Cross-site scripting - Reflected via upload .xml file looks incomplete.

It just will set the mime type to text/xml for XML files to avoid XSS, However, this one can be also used to perform XSS too.

Since an XML file can contain HTML namespace, when the browser renders it, the javascript can be executed.

Proof of Concept

Upload the following file with .xml extension

<x:script xmlns:x="http://www.w3.org/1999/xhtml">alert(document.domain)</x:script>

Impact

Stored-XSS allows attackers to perform arbitrary actions on behalf of victims on the client-side.

Stealing Cookies

Redirect users to malicious sites for phishing and etc...

We are processing your report and will contact the neorazorx/facturascripts team within 24 hours. a month ago
We have contacted a member of the neorazorx/facturascripts team and are waiting to hear back a month ago
We have sent a follow up to the neorazorx/facturascripts team. We will try again in 7 days. a month ago
Carlos Garcia validated this vulnerability a month ago
Anna has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Carlos Garcia confirmed that a fix has been merged on f1ca50 a month ago
The fix bounty has been dropped
to join this conversation