Authenticated SVG File Upload Vulnerability in Aureus ERP

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Aureus ERP versions up to 1.6.0. Authenticated users can upload malicious SVG files containing JavaScript code. These files are stored on the public disk and served from the application's origin. When accessed directly via URL, the embedded scripts execute in the application's context, enabling actions like session cookie theft or CSRF token exfiltration.

Useful 0 Not Useful 0

Detection Guidance

Check for uploaded SVG files in public directories, especially under branding or company logo upload paths. Inspect file contents for embedded JavaScript or script tags. Review server logs for direct access to SVG files via URLs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies or CSRF tokens, perform account defacement, or execute actions on behalf of the victim. This requires the victim to access the malicious SVG file directly via its URL after upload.

Useful 0 Not Useful 0

Mitigation Strategies

Block SVG file uploads entirely or restrict to trusted sources. Implement strict file type validation to reject SVG files with embedded scripts. Update to the patched version that blocks SVG uploads and prevents preserved filenames on public disk.

Useful 0 Not Useful 0