PT-2024-40192 · Unknown · Ruby On Rails+1
Published
2024-09-23
·
Updated
2024-09-23
CVSS v4.0
4.8
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
Name of the Vulnerable Software and Affected Versions:
Camaleon CMS (affected versions not specified)
Description:
A stored cross-site scripting issue has been found in the image upload functionality, allowing normal registered users to upload SVG images containing JavaScript or HTML documents by manually changing the format parameter. This can lead to malicious JavaScript execution on behalf of authenticated users or administrators, potentially resulting in account takeover due to reflected Cross-site scripting (XSS).
Recommendations:
To resolve the issue, consider the following:
Only allow the upload of safe files such as PNG, TXT, and others.
Serve all "unsafe" files such as SVG and other files with a content-disposition: attachment header to prevent browsers from displaying them.
Create a Content security policy (CSP) that disallows inlined script, and modify other parts of the application as needed to continue functioning.
Mark the auth token with HttpOnly to prevent theft.
Consider using the authentication provided by Ruby on Rails to limit the use of stolen tokens.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Camaleon Cms
Ruby On Rails