Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Bug] 未授权上传文件导致XSS漏洞 #4798

Closed
hbdxmz opened this issue Mar 16, 2023 · 2 comments
Closed

[Bug] 未授权上传文件导致XSS漏洞 #4798

hbdxmz opened this issue Mar 16, 2023 · 2 comments
Assignees
@BBchicken-9527 @zrfit
Labels
状态:已完成 类型:bug Something isn't working
Milestone
v1.18.5

Comments

@hbdxmz
Copy link

hbdxmz commented Mar 16, 2023

DataEase 版本
v1.18.4

Bug 描述
文件上传未作权限校验，未登录用户可以直接向后台上传任意文件，文件类型未作校验，可以上传任意类型文件

Bug 重现步骤
漏洞接口：static/resource/upload/

  1. 向static/resource/upload/接口上传一个html，html中的js用于弹出cookie，我把cookie删除了，任然可以上传成功
    image

3.上传文件名为b1ace870-c3d6-11ed-9218-a9fe7c2f5491，文件名不重复即可

4.文件上传后存储在了static-resource目录，访问http://192.168.253.1:8091/static-resource/b1ace870-c3d6-11ed-9218-a9fe7c2f5491.html

弹出了cookie信息，形成存储XSS漏洞
image
@hbdxmz hbdxmz added the 类型:bug Something isn't working label Mar 16, 2023
@BBchicken-9527
Copy link

感谢反馈，我们会尽快修复

@xuwei-fit2cloud xuwei-fit2cloud added this to the v1.18.5 milestone Mar 20, 2023
@hbdxmz hbdxmz closed this as completed Mar 20, 2023
@hbdxmz hbdxmz reopened this Mar 20, 2023
@xuwei-fit2cloud
Copy link
Contributor

v1.18.5版本已处理，请升级最新版本。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@BBchicken-9527 BBchicken-9527

@zrfit zrfit

Labels
状态:已完成 类型:bug Something isn't working
Projects
None yet
Milestone
v1.18.5
Development

No branches or pull requests
4 participants
@xuwei-fit2cloud @BBchicken-9527 @hbdxmz @zrfit