Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk


Reported on

Nov 11th 2021


Stored XSS via upload 'Attachments' with format .svg or .html


When opening the attachment, some format files will be rendered and loaded on the browser. So it allows executing arbitrary javascript code that was injected into attachment before.

Proof of Concept

// PoC.svg
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "">

<svg version="1.1" baseProfile="full" xmlns="">
   <rect width="300" height="100" style="fill:rgb(0,0,255);stroke-width:3;stroke:rgb(0,0,0)" />
   <script type="text/javascript">

Step top Reproduct

Create a ticket with an unauthenticated user

Upload .svg or .html into attachments

The XSS will trigger when the admin open the attachment


This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie.

We are processing your report and will contact the django-helpdesk team within 24 hours. 2 years ago
We have contacted a member of the django-helpdesk team and are waiting to hear back 2 years ago
Garret Wassermann validated this vulnerability 2 years ago
lethanhphuc has been awarded the disclosure bounty
The fix bounty is now up for grabs
lethanhphuc submitted a
2 years ago
2 years ago



Garret Wassermann marked this as fixed with commit 04483b 2 years ago
lethanhphuc has been awarded the fix bounty
This vulnerability will not receive a CVE
Jamie Slome
2 years ago


CVE published! 🎊

to join this conversation