| Título | Mereithhh VanBlog 0.54.0 Cross-Site Scripting |
|---|
| Descrição | VanBlog (self-hosted blog system, NestJS + MongoDB) does not validate the type of
uploaded files in the image upload endpoint POST /api/admin/img/upload. The stored
file name keeps the client-supplied extension, the bytes are written verbatim into
the static directory served by express.static, and the response Content-Type is
derived from that extension; neither Content-Security-Policy nor
X-Content-Type-Options: nosniff is emitted.
The route is additionally whitelisted for collaborators in
packages/server/src/types/access/access.ts (line 50), so a collaborator whose
permissions array is empty can still upload: the same token receives HTTP 403 on
GET /api/admin/setting/static but HTTP 201 on POST /api/admin/img/upload.
An attacker can therefore store an HTML or SVG document containing JavaScript on
the site origin. Because /static and /admin are served from the same origin by the
shipped Caddy configuration, that script reads localStorage["token"] (the
administrator JWT) when an administrator opens the uploaded file, resulting in full
administrative takeover.
On the released Docker image v0.54.0 a plain .html upload is rejected with HTTP 500,
but an .svg containing an inline script (or a GIF89a-header polyglot named .html) is
accepted and served as image/svg+xml. On a not-yet-initialized instance,
POST /api/admin/init/upload requires no authentication at all.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N = 8.7 (authenticated),
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N = 9.3 (non-initialized instance).
CWE-79, CWE-434, CWE-284. |
|---|
| Fonte | ⚠️ http://note.geronimo.xin/post/70 |
|---|
| Utilizador | Geronimo (UID 102234) |
|---|
| Submissão | 19/10/2026 12h21 (há 25 dias) |
|---|
| Moderação | 13/11/2026 21h00 (25 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 437297 [Mereithhh VanBlog até 0.54.0 Image Upload Endpoint access.ts Script de Site Cruzado] |
|---|
| Pontos | 19 |
|---|