Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) issue in Homarr versions prior to 1.43.3. It occurs because the application improperly renders malicious SVG files uploaded by an attacker. When an administrator views a page that renders or redirects to the malicious SVG, arbitrary JavaScript code can execute in their browser with minimal or no user interaction. This can allow the attacker to escalate privileges by adding their account to the 'credentials-admin' group, granting full administrative access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to an attacker gaining full administrative access to the Homarr dashboard by exploiting the stored XSS flaw. If an administrator views the malicious SVG, the attacker can execute arbitrary JavaScript to add their account to the 'credentials-admin' group. This compromises the security and integrity of the system, potentially allowing unauthorized control and access to sensitive information or administrative functions.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Homarr to version 1.43.3 or later, as this version contains the patch that fixes the stored XSS vulnerability caused by malicious SVG file rendering.

Useful 0 Not Useful 0