PT-2022-20445 · Unknown · Fof Upload

Safwat Refaat · Published 2022-05-25 · Updated 2022-06-10 · CVE-2022-30999

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FoF Upload versions prior to 1.2.3

Description The issue allows arbitrary Javascript code execution when navigating directly to an SVG file URI, potentially leading to data leakage or malicious modification by an authenticated Flarum user. This is possible if FoF Upload is configured to allow the uploading of SVG files (image/svg+xml). The executed Javascript code could include HTTP web requests to Flarum or other web services.

Recommendations For FoF Upload versions prior to 1.2.3, upgrade to version 1.2.3, which sanitizes uploaded SVG files, or remove the ability for users to upload SVG files through FoF Upload as a temporary workaround.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-30999

GHSA-FM53-MPMP-7QW2

Affected Products

Fof Upload

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30999.json · Exploit
• 🔥 https://github.com/FriendsOfFlarum/upload/issues/68 · Exploit
• https://github.com/FriendsOfFlarum/upload/pull/318 · Patch
• https://github.com/FriendsOfFlarum/upload/releases/tag/1.2.3 · Patch
• https://osv.dev/vulnerability/GHSA-fm53-mpmp-7qw2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30999 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30999 · Security Note
• https://github.com/FriendsOfFlarum/upload · Note
• https://github.com/FriendsOfFlarum/upload/security/advisories/GHSA-fm53-mpmp-7qw2 · Note
• https://t.me/cibsecurity/43710 · Telegram Post