Stored XSS in PostyBirb Plus Submission Description Editor

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in PostyBirb Plus up to version 3.1.75. It allows attackers to inject malicious JavaScript into the submission description editor. The flaw occurs because the app renders stored HTML descriptions without proper sanitization, enabling event handlers in attacker-controlled content to execute with full privileges. The vulnerability stems from the UI renderer running with contextIsolation disabled, exposing sensitive data like AUTH_ID tokens and account credentials.

Useful 0 Not Useful 0

Detection Guidance

Check for PostyBirb Plus versions prior to 3.1.76. Inspect submissions for malicious HTML in descriptions, particularly event handlers like onerror in img tags. Monitor network traffic for unauthorized data exfiltration or redirects.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal your AUTH_ID token, all stored site credentials, and account cookies. They could also redirect your API and WebSocket traffic to malicious servers. The attack is triggered when you import a malicious FurAffinity archive or open an imported submission's edit page, executing the payload silently.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to potential unauthorized access to sensitive user data like authentication tokens and cookies. Stored XSS attacks may expose personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade PostyBirb Plus to version 3.1.76 or later. Apply the patch commit 6b11c2345ad98ae59fd5404a9f1024eb1d10c8a4. Review and sanitize all existing submissions, especially descriptions, to remove malicious HTML.

Useful 0 Not Useful 0