Stored XSS in Koillection via Malicious HTML File Upload

Executive Summary

Koillection through version 1.8.4 has a stored cross-site scripting (XSS) vulnerability. Authenticated users can upload HTML files as attachments without proper MIME type restrictions. These files are stored and served as text/html from the public/uploads directory. When accessed, the HTML payload executes JavaScript in the victim's browser session, allowing attackers to perform actions on their behalf.

Useful 0 Not Useful 0

Detection Guidance

Check for uploaded HTML files in the public/uploads directory of Koillection installations. Look for files with .html extensions or unusual filenames in POST requests to /api/data/{id}/file. Monitor for unexpected JavaScript execution in user sessions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies, perform actions as the victim (e.g., modifying data), or redirect users to malicious sites. Since the payload is stored, it affects all users who access the uploaded file, including administrators if the file is uploaded in a privileged context.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosure, or loss of data integrity, potentially leading to regulatory penalties or fines.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Koillection to a patched version if available. Restrict file uploads to safe MIME types (e.g., only allow images or PDFs). Implement strict Content-Type checks for uploaded files. Review and remove any suspicious HTML files from public/uploads.

Useful 0 Not Useful 0