GHSA-p74g-f95m-7fx7: traQ: XSS in the User Uploaded File Retrieval API
traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQSTORAGETYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
traQto a version that resolves this vulnerability.Fixed in 3.28.3
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments are traQ instances prior to version 3.28.3 that use local storage, configured with TRAQ_STORAGE_TYPE=local. The issue concerns the /files/{fileId} file-retrieval endpoint serving uploaded SVG or HTML for direct browser rendering.
What does an attacker need to exploit this issue?
The attacker needs permission to upload files and must get another user to open the crafted file's URL. The uploaded SVG or HTML can then execute attacker-controlled JavaScript in that victim's browser.
What is the remediation?
Upgrade traQ to version 3.28.3, which fixes the issue.