CVE-2024-52305: UnoPim Stored XSS : Cookie hijacking through Create User function
Summary A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies.
Details 1. Login as admin 2. Go to Create User 3. Fill up everything in the registration form then upload SVG image as a profile picture 4. In SVG image, add script tag to prepare for XSS attack 5. Complete the Create User process 6. Right click at the image to obtain image URL address 7. XSS triggered PoC The below link is a private YouTube video for PoC. https://youtu.be/5j8owD0--1A
Impact The stored XSS can lead to session hijacking and privilege escalation, effectively bypassing any CSRF protections in place.
Other sources
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies. This vulnerability is fixed in 0.1.5.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52305?
CVE-2024-52305 has a medium severity rating due to the potential for an attacker to create an admin account and execute malicious scripts.
How do I fix CVE-2024-52305?
To fix CVE-2024-52305, upgrade the Unopim package to version 0.1.5 or later as it contains the necessary security patches.
Which versions of Unopim are affected by CVE-2024-52305?
CVE-2024-52305 affects the Unopim package versions up to and including 0.1.5.
What types of files can be uploaded due to CVE-2024-52305?
CVE-2024-52305 allows an attacker to upload malicious SVG files that can contain embedded scripts.
What are the potential impacts of exploiting CVE-2024-52305?
Exploitation of CVE-2024-52305 could lead to unauthorized access and execution of malicious scripts on the server.