Stored XSS in REDAXO CMS via SVG Upload

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in REDAXO CMS versions 5.18.0 to 5.21.3. The rex_media_service moves uploaded SVG files to a public media folder before sanitizing them. Authenticated users with mediapool upload rights can exploit this by uploading malicious SVG files that bypass sanitization, either by racing the sanitizer or exhausting memory limits. This results in script-laden SVGs being publicly served, executing scripts in victims' backend sessions when accessed.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized SVG files in public media folders of REDAXO installations. Look for files with malicious scripts in their content. Monitor network traffic for unexpected script executions from SVG files.

Useful 0 Not Useful 0

Impact Analysis

An attacker with mediapool upload permissions could upload a malicious SVG file containing JavaScript. If another user accesses the raw SVG file URL or via an iframe, the script executes in the backend's origin. This could compromise the victim's session, leading to potential data theft, unauthorized actions, or further exploitation of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. If exploited, it may result in data breaches, requiring notifications to authorities and affected individuals, and potentially leading to regulatory fines or penalties for non-compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade REDAXO to version 5.21.4 or later. Restrict mediapool upload permissions to trusted users. Block SVG uploads by adding 'svg' to blocked extensions. Configure CSP headers to prevent script execution in SVGs.

Useful 0 Not Useful 0