serenity.net.services and serenity.net.core are vulnerable to Cross-Site Scripting (XSS) attacks. The library does not properly check for specific prohibited file types, allowing an attacker to upload malicious .html
or .htm
files containing XSS payloads.
packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html
seclists.org/fulldisclosure/2023/May/14
github.com/advisories/GHSA-93h6-wx7r-mgfp
github.com/serenity-is/Serenity/commit/11b9d267f840513d04b4f4d4876de7823a6e48d2
github.com/serenity-is/Serenity/commit/f54e9bfcf8ceb7f26f81a7362349bc1f63251d92