XSS via Unvalidated File Upload

The application does not perform proper checks on images uploaded via the WYSIWYG editor when creating new pages.

Malicious users are able to modify new images uploads, changing the file name and extension type to .html allowing the execution of potentially malicious code for any user visiting the relevant image URL.

NOTE: I was unable to reproduce this using Tomcat and MySQL via the latest Docker image when testing.

Recommendations

Perform validation on the file extension before file uploads are persisted in the DB. Create a case-insensitive check against an allow-list of safe file types and reject any uploads that do not meet this.

Version info

Steps to Reproduce

1. Download the Jetty/HSQLDB trial/test instance from: https://www.xwiki.org/xwiki/bin/view/Download/DownloadVersion/?projectVersion=12.10.8
2. Unzip and run start.sh
3. Log in as an admin.
4. Create a new application.
5. After creating application, click 'ADD NEW ENTRY' and save name in modal.
6. Click 'edit'/pencil icon next to new entry.
7. Click '+ Create' 
8. Add a title and select 'Blank Page' from the 'TYPE' options and select 'Create'.
9. Upoad a local image.
10. Intercept the image upload with proxy software such as Burp Suite and make the following changes:
    1. Change 'filename' to xss.html.
    2. Change 'Content-Type' to text/plain.
    3. Remove the image data and replace with the below Javascript:

<script>alert(document.location)</script>

1. Forward or replay the request. Make a note of the url field in the server response.
2. Copy and paste the url field value into a browser. Code should execute.

POST Request

Server Response

Code executed