| 제목 | https://github.com/jeecgboot JeecgBoot 3.9.2 Cross Site Scripting |
|---|
| 설명 | JeecgBoot contains a stored Cross-Site Scripting (XSS) vulnerability caused by unauthorized file uploads. Anonymous attackers can directly access the unauthenticated upload interface /airag/chat/upload. The backend file validation allows file formats supporting JavaScript scripts such as SVG and HTML. Uploaded files are persistently stored on the server disk, and the framework’s static resource routing exposes the upload directory to public access, enabling any user to retrieve uploaded files directly.
An attacker may upload an SVG file embedded with malicious JavaScript. When other backend administrators visit the static resource link of this uploaded file, the browser will automatically execute the malicious script under the same origin context. This flaw allows theft of session cookies, account hijacking, and unauthorized invocation of sensitive backend APIs. Exploitation of this vulnerability requires no authentication, posing an extremely high security risk. |
|---|
| 원천 | ⚠️ https://github.com/jeecgboot/JeecgBoot/issues/9773 |
|---|
| 사용자 | 0kam1 (UID 99762) |
|---|
| 제출 | 2026. 07. 13. PM 05:12 (3 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 29. PM 04:43 (2 months later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 391454 [JeecgBoot 3.9.2 /airag/chat/upload 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 0 |
|---|