Stored XSS in R-SOFT DMS File Upload

Executive Summary

The vulnerability in R-SOFT DMS is a Stored Cross-Site Scripting (XSS) issue found in the file upload functionality.

An authenticated attacker can inject arbitrary HTML and JavaScript code into the name of the file being uploaded.

This malicious code is then executed when other users visit the file list or upload status pages, potentially compromising their security.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves stored XSS in the file upload functionality of R-SOFT DMS, where an authenticated attacker can inject arbitrary HTML and JavaScript into the filename. Detection involves checking for suspicious or malicious scripts embedded in filenames of uploaded files.

To detect this on your system, you can inspect the filenames in the file upload directories or the file list interface for suspicious HTML or JavaScript code.

Example commands to help detect potentially malicious filenames include:

• Using grep to find filenames containing script tags or suspicious HTML in the upload directory: grep -r -i '<script' /path/to/uploaded/files
• Listing files with suspicious characters in their names: find /path/to/uploaded/files -name '*<*' -o -name '*>*' -o -name '*"*' -o -name "*'"
• Reviewing web interface logs or database entries for filenames containing HTML or JavaScript code.

Additionally, ensure your R-SOFT DMS version is updated to v3.19-2832 or v3.17-2580 or later, where this issue is fixed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to execute malicious scripts in the context of other users' browsers.

Such execution can lead to theft of sensitive information, session hijacking, or performing actions on behalf of the victim user.

Since the attack requires authentication, it may be limited to users with some level of access, but it still poses a significant risk to user data and system integrity.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated attacker to inject arbitrary HTML and JavaScript into file names, which can be executed by other users when viewing file lists or upload statuses. This could lead to unauthorized access to user data or session hijacking.

Such security issues may impact compliance with standards like GDPR and HIPAA, which require protection of personal data and secure handling of user information to prevent unauthorized access or data breaches.

However, the provided information does not explicitly describe the direct impact on compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade R-SOFT DMS to version v3.19-2832 or v3.17-2580 where the issue has been fixed.

Useful 0 Not Useful 0