XSS (via SVG file upload) in Monstra-dev

[security-breachlock]

Affected software: Monstra-dev

Type of vulnerability: XSS (via SVG file upload)

Discovered by: BreachLock

Website: https://www.breachlock.com

Author: Balvinder Singh

Description: SVG files can contain Javascript in <script> tags. Browsers are smart enough to ignore scripts embedded in SVG files included via IMG tags. However, a direct request for a SVG file will result in the scripts being executed.
So an embedded SVG as an attachment in an issue or avatar does not execute the code, but if a user clicks on the attachment the code will execute.

Proof of concept:

Step1: Login to the monstra-dev cms.
Step2: In the content section, choose files and upload a malicious SVG file.
URL: http://localhost/monstra-dev/monstra-dev/admin/index.php?id=filesmanager&path=uploads/

Step3: Now open that file which was saved as 1.svg the below output will be shown.

VulnerableURL: http://localhost/monstra-dev/monstra-dev/public/uploads/1.svg

[security-breachlock]

Hi Team,

Any updates regarding the patch.