| शीर्षक | Mereithhh VanBlog 0.54.0 Cross-Site Scripting |
|---|
| विवरण | VanBlog (self-hosted blog system, NestJS + MongoDB) does not validate the type of
uploaded files in the image upload endpoint POST /api/admin/img/upload. The stored
file name keeps the client-supplied extension, the bytes are written verbatim into
the static directory served by express.static, and the response Content-Type is
derived from that extension; neither Content-Security-Policy nor
X-Content-Type-Options: nosniff is emitted.
The route is additionally whitelisted for collaborators in
packages/server/src/types/access/access.ts (line 50), so a collaborator whose
permissions array is empty can still upload: the same token receives HTTP 403 on
GET /api/admin/setting/static but HTTP 201 on POST /api/admin/img/upload.
An attacker can therefore store an HTML or SVG document containing JavaScript on
the site origin. Because /static and /admin are served from the same origin by the
shipped Caddy configuration, that script reads localStorage["token"] (the
administrator JWT) when an administrator opens the uploaded file, resulting in full
administrative takeover.
On the released Docker image v0.54.0 a plain .html upload is rejected with HTTP 500,
but an .svg containing an inline script (or a GIF89a-header polyglot named .html) is
accepted and served as image/svg+xml. On a not-yet-initialized instance,
POST /api/admin/init/upload requires no authentication at all.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N = 8.7 (authenticated),
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N = 9.3 (non-initialized instance).
CWE-79, CWE-434, CWE-284. |
|---|
| स्रोत | ⚠️ http://note.geronimo.xin/post/70 |
|---|
| उपयोगकर्ता | Geronimo (UID 102234) |
|---|
| सबमिशन | 19/10/2026 12:21 PM (25 दिन पहले) |
|---|
| संयम | 13/11/2026 09:00 PM (25 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 437297 [Mereithhh VanBlog तक 0.54.0 Image Upload Endpoint access.ts क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 19 |
|---|