Submeter #579781: newbee-ltd newbee-mall v1.0 Unrestricted Upload

Arbitrary File Upload vulnerability in newbee-mall allows leads to Stored Cross-Site Scripting via

# NAME OF AFFECTED PRODUCT(S)

- NewBee-Mall

## Vendor Homepage

https://github.com/newbee-ltd/newbee-mall

# AFFECTED AND/OR FIXED VERSION(S)

## submitter
- aiyakami,Yveslawtox

## Vulnerable File
- UploadController.java

## VERSION(S)
- All versions

## Software Link
- [https://github.com/newbee-ltd/newbee-mall](https://github.com/newbee-ltd/newbee-mall)

# PROBLEM TYPE

## Vulnerability Type

- Arbitrary File Upload → Stored XSS

## Root Cause

- The file upload feature in newbee-mall fails to properly validate file content types and extensions (e.g., .svg, .html). Attackers can upload malicious files containing JavaScript code, which are then rendered by victims' browsers, leading to persistent Cross-Site Scripting (XSS).

## Impact

- Attackers can upload malicious files disguised as images, which, when rendered by the application or accessed by users, execute arbitrary JavaScript in their browsers.

#Successful exploitation can lead to:

- Session hijacking (stealing cookies via document.cookie).

- Phishing attacks (fake login forms injected via XSS).

- Defacement (modifying website content to display false information).

- Malware distribution (redirecting users to malicious sites).

# DESCRIPTION

- During a security review of NewBee-Mall, a critical arbitrary file upload vulnerability was discovered in UploadController.java. The issue arises due to inadequate file validation, allowing attackers to upload malicious files that bypass security checks.

# Vulnerability details and POC

## Vulnerability lonameion:

- **`UploadController.java`**

## Payload:

Example: An attacker uploads an JPG file containing <script>alert(1)</script>, which executes when rendered in a browser.

```
POST /admin/upload/file HTTP/1.1
Host: localhost:28089
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybO8yOGzIYPRskMIq
Upgrade-Insecure-Requests: 1
sec-ch-ua-mobile: ?0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://localhost:28089/admin/goods/edit
sec-ch-ua-platform: "Windows"
Origin: http://localhost:28089
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="136", "Google Chrome";v="136", "Not.A/Brand";v="99"
Cookie: JSESSIONID=1AA4DEAFD79313CF65E57EC00062D9EC
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Sec-Fetch-Site: same-origin
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: zh-CN,zh;q=0.9
Sec-Fetch-Mode: navigate
Content-Length: 131651

------WebKitFormBoundarybO8yOGzIYPRskMIq
Content-Disposition: form-data; name="file"; filename="10.html"
Content-Type: image/jpeg

```

## The following are screenshots of some specific information obtained from testing and running with the yakit tool:



# Suggested repair

1. **Strict File Extension Whitelisting**

Only allow safe extensions (e.g., .jpg, .png, .gif) and reject dangerous ones (e.g., .svg, .html, .php).

2. **File Content Validation**

Check file magic numbers (first few bytes) to ensure the file matches its extension, and scan the file content for dangerous patterns (e.g., <script>, alert(, document.cookie) to prevent embedded malicious scripts.

• Fonte: ⚠️ https://github.com/Aiyakami/CVE-1/issues/2
• Utilizador: aiyakami (UID 85128)
• Submissão: 17/05/2025 12h03 (há 1 Ano)
• Moderação: 18/05/2025 08h50 (21 hours later)
• Estado: Duplicado
• Entrada VulDB: 307363 [newbee-mall 1.0 UploadController.java upload Ficheiro Elevação de Privilégios]
• Pontos: 0