Cross-Site Scripting in Omega Solution HRM OS via SVG File Upload

Executive Summary

This is a Stored Cross-Site Scripting (Stored XSS) vulnerability in Omega Solution HRM OS. It occurs because the application does not properly validate or sanitize uploaded SVG files, allowing embedded JavaScript to execute when the file is viewed. The attack is persistent as the malicious payload remains on the server and executes automatically for any user accessing the SVG file.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect uploaded SVG files for embedded JavaScript or active content. Check the /media/view/ endpoint for stored SVG files that execute scripts when accessed. Use tools like curl to fetch SVG files and review their content for malicious payloads.

Useful 0 Not Useful 0

Impact Analysis

An attacker could upload a malicious SVG file containing JavaScript. When you or other users view the file, the embedded script runs in your browser, potentially stealing session cookies, performing unauthorized actions on your behalf, or delivering further attacks like phishing or credential theft.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. It may result in data breaches, unauthorized disclosures, or compromised user accounts, potentially leading to regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Disable SVG uploads if not required. If SVG uploads are necessary, sanitize files to remove scripts and event handlers. Serve uploaded files with a restrictive CSP. Convert SVG files to safe raster formats before serving. Treat all uploaded files as untrusted.

Useful 0 Not Useful 0