Stored XSS in Thelia via SVG File Upload

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Thelia versions before 3.1.1. Authenticated back-office administrators with store update permissions can upload unsanitized SVG files for store logos or banners. These files contain malicious scripts that execute when accessed via admin or public URLs, affecting both visitors and higher-privileged users.

Useful 0 Not Useful 0

Detection Guidance

Check for unsanitized SVG files in /admin/store-media/logo or public cache/images/store/ directories. Look for files with onload payloads or event handlers in SVG content. Use commands like 'find /path/to/webroot -name "*.svg" -exec grep -l "onload\|javascript:" {} \;' to search for suspicious SVGs.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to execute malicious scripts against visitors and administrators. This could lead to session hijacking, data theft, or defacement of the website. The vulnerability allows persistent XSS, meaning the malicious payload remains active until the SVG file is removed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting user data. Non-compliance may result in legal penalties, reputational damage, and loss of customer trust due to unauthorized access to sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Thelia to version 3.1.1 or later. Clear the image cache after updating. Restrict file uploads to raster formats (PNG, JPEG, GIF, WEBP) and sanitized SVGs. Review uploaded SVGs for malicious content and remove any suspicious files.

Useful 0 Not Useful 0