search

Studio-42 / elFinder

📁 Open-source file manager for web, written in JavaScript using jQuery and jQuery UI
https://studio-42.github.io/elFinder/
Other
4.6k stars 1.41k forks source link

Filename Restriction Bypass Leading To Persistent Cross-site Scripting Vulnerability #3617

Closed passtheticket closed 6 months ago

passtheticket commented 7 months ago

Describe the bug A html file can be uploaded with .html.aaa or .htm.aaa file extensions. When the file is opened, it executes the Javascript code inside it. On the other hand, file uploading with the .html. and .htm. file extensions are enough to execute Javascript for Linux servers. The WinRemoveTailDots plugin prevents uploading these file extensions using rtrim function for Windows server.

To Reproduce

  1. Select arbitrary png file to upload.
  2. Capture request with Burp and set content as test<img/src/onerror=alert(document.cookie)>
  3. Set filename like test.html.aaa or test.htm.aaa
  4. After forwarding the request, the file is successfully uploaded under the files directory.

Screenshots 7 8

Tested on:

nao-pon commented 6 months ago

@passtheticket Thank you for your report. I think this problem is caused by the fact that MIME detection of multiple extensions is not supported. I will fix this.