Stored XSS via SVG File Upload
Package
Affected versions
>= 7.0.0, < 7.15.11
>= 8.0.0, < 8.18.9
>= 9.0.0, < 10.7.0
>= 11.0.0, < 11.5.0
>= 12.0.0, < 12.2.0
Patched versions
7.15.11
8.18.9
10.7.0
11.5.0
12.2.0
Description
Published by the National Vulnerability Database
Dec 12, 2023
Published to the GitHub Advisory Database
Dec 13, 2023
Reviewed
Dec 13, 2023
Credits
-
S3ntago Reporter
Impact
A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed.
Workaround
Implement the server side file validation
https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation
or
Serve all media from an different host (e.g cdn) that where umbraco is hosted
References