ARIS: Business Process Management 10.0.21.0 Cross Site Scripting

`# Exploit Title: Stored Cross-Site Scripting (XSS) in ARIS: Business  
Process Management  
# Edition Version 10.0.21.0  
# Exploit Author: Seid Yassin  
# Date: 2024-03-28  
# Vendor: Software AG  
# Software Link: https://aris.com/  
# Version: ARIS: Business Process Management  
  
## Description:  
  
Discovered a file upload feature lacking proper file extension validation.  
This vulnerability allows attackers to upload any type of file, including  
malicious ones. To demonstrate this, we successfully uploaded an SVG file  
to carry out a Cross-Site Scripting (XSS) attack. In XSS attacks, malicious  
scripts are injected into web pages viewed by other users, potentially  
leading to data theft or unauthorized actions leading to potential theft of  
cookies and session tokens.  
  
## Background:  
  
Cross-site scripting (XSS) is a common web security vulnerability that  
compromises user interactions with a vulnerable application. Stored XSS  
occurs when user input is stored in the application and executed whenever a  
user triggers or visits the page.  
  
## Issue:  
  
A stored cross-site scripting (XSS) vulnerability in ARIS: Business Process  
Management software enables a malicious authenticated user to store a xss  
payload(via SVG) using the web interface. Then, when viewed by a properly  
authenticated user or administrator, the JavaScript payload executes within  
SVG and disguises all associated actions as performed by that unsuspecting  
authenticated user/administrator.  
  
## Steps To Reproduce:  
  
1. Log into the ARIS application.  
2. Navigate to my tasks and select any of the task and upload documents  
(change request form)  
3. Insert any svg file with xss script in it . eg.  
https://gist.github.com/rudSarkar/76f1ce7a65c356a5cd71d058ab76a344  
  
## Expected Result:  
  
After a user uploads a new document in the Change Request Form, they can  
utilize the link for the SVG file and UUID to access another path at  
{{url}}/documents/api/documents/{{UUID}}/content  
  
## Actual Result:  
  
The ARIS application is vulnerable to Stored Cross-Site Scripting, as  
evidenced by the successful execution of the injected payload.  
  
## Proof of Concept:  
  
Attached Screenshots for the reference.  
`