Stored XSS in Ech0 File Upload via Client-Supplied Headers

Executive Summary

CVE-2026-79670 is a stored cross-site scripting (XSS) vulnerability in the Ech0 application before version 4.4.3. It occurs because the file upload endpoint only checks the Content-Type header provided by the client without performing server-side validation. Attackers with admin privileges can upload malicious SVG or HTML files containing JavaScript that executes in the application's origin when accessed by any user.

Useful 0 Not Useful 0

Detection Guidance

Check for uploaded SVG or HTML files in the Ech0 application's file storage. Inspect Content-Type headers and file extensions for mismatches. Use tools like curl to test file upload endpoints for improper validation. Example: curl -X POST -F 'file=@malicious.svg' http://target/upload

Verify if the server serves files with incorrect MIME types. Check for missing security headers like X-Content-Type-Options or Content-Security-Policy.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to upload malicious files that execute JavaScript when accessed by users. This can lead to session hijacking, where attackers steal user sessions, and data exfiltration, where sensitive data is stolen. The attack requires admin privileges to upload the file initially but persists even after admin accounts are secured.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR and HIPAA by enabling unauthorized data exfiltration and session hijacking. Stored XSS allows attackers to steal sensitive user data or session tokens, which may lead to breaches of confidentiality requirements under these regulations. The lack of proper file validation and security headers increases the risk of non-compliance with data protection standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Ech0 to version 4.4.3 or later to patch the vulnerability. Implement server-side Content-Type validation using magic bytes instead of client headers.

Remove image/svg+xml from allowed file types or sanitize SVG files. Add security headers like X-Content-Type-Options: nosniff and Content-Security-Policy.

Serve uploaded files with Content-Disposition: attachment or from a separate origin to isolate them from the application's cookie scope.

Useful 0 Not Useful 0