Cross-Site Scripting in Rocket LMS Student Profile Image Upload

Executive Summary

This is a Stored Cross-Site Scripting (Stored XSS) vulnerability in Rocket LMS version 2.2 affecting the Student Profile Image upload feature. The application allows authenticated students to upload SVG files containing malicious JavaScript without validating or sanitizing the file contents. Once uploaded, the SVG executes JavaScript in the application's context when accessed.

Useful 0 Not Useful 0

Detection Guidance

Check for uploaded SVG files in the Rocket LMS profile image directory. Look for files with .svg extension in the uploads folder. Use commands like 'find /path/to/uploads -name "*.svg"' to locate them. Inspect file contents for embedded JavaScript or event handlers using 'grep -r "<script>" /path/to/uploads' or 'grep -r "onerror=" /path/to/uploads'.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies, capture credentials, perform phishing attacks, manipulate the DOM, redirect users, deface the application, or take unauthorized actions on behalf of users who view the malicious profile image. The impact depends on user privileges and application context.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. It may result in non-compliance due to insufficient protection against cross-site scripting attacks.

Useful 0 Not Useful 0

Mitigation Strategies

Disable SVG uploads for profile images and restrict uploads to safe formats like PNG, JPG, or WEBP. If SVG support is required, sanitize SVG files using a trusted library, remove script elements and event handlers, and serve SVG files from a separate domain. Implement Content Security Policy (CSP) and set Content-Disposition: attachment headers for SVG files.

Useful 0 Not Useful 0