Cross Site Scripting Issue in PrestaShop Using File Upload Functionality

[p1nk15amak]

An issue is discovered in PrestaShop version 1.7.6.7 under the Catelog feature when using the file-upload functionality for uploading the Files for various products. This issue exists because it fails to implement file content checks and improperly handles the output, resulting in cross-site scripting attack that leads to cookie stealing or malicious actions.

Steps to Reproduce

1. Go to Catelog feature
2. Click on File component and add the details accordingly.
3. Create a file with .html extension and enter the payload <script>alert('XSS!!');</script>within it. (Here its, uplod.html)
4. Upload the file
5. Login as customer and click on the file uploaded for the particular product.
6. You can see the XSS payload gets executed.

CVSS Score:
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

[prestashop-issue-bot]

Thanks for opening this issue! We will help you to keep its state consistent

[matks]

Hi @p1nk15amak ! thank you for the report

Am I wrong if I guess that you had a look at our newly opened bug bounty and that you found this while bug hunting, but since the CVS score is low, you reported it here ?

[PierreRambaud]

Hi,

This is something we already received on the Bug Bounty program.
Unfortunately, this is not a security issue, as we allow to upload any files we wanted, (it's the same for SVG files), any users with admin employee can upload this kind of file, like he's able to upload a module or a theme with comprised data.

Kind regards