Stored XSS in FastSchema via SVG Upload Bypass

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in fastschema versions up to v0.15.1. An attacker with low privileges can upload an SVG file containing malicious JavaScript by tricking the system into accepting it as a valid image. The vulnerability exists because the software checks the file's MIME type header instead of the actual file content, allowing an attacker to rename a malicious file to .jpg while specifying image/svg+xml to bypass filters and store the script in the web root.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect uploaded files for SVG content disguised as other file types (e.g., .jpg). Check web server directories for unexpected SVG files containing JavaScript. Review logs for PUT requests with Content-Type headers set to image/svg+xml for non-SVG files.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to inject malicious scripts into web pages viewed by other users. This could lead to theft of session cookies, account takeovers, or defacement of the website. Since the payload is stored on the server, it affects all users who access the compromised pages without requiring further interaction from the attacker.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. It may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to a patched version of fastschema beyond v0.15.1. Implement strict file content validation instead of relying on Content-Type headers. Remove or sanitize any suspicious SVG files already present in the web root. Restrict file upload permissions to trusted users only.

Useful 0 Not Useful 0