REDHAT-BUG-2486194: CSRF
The filedrop endpoint (POST /api/v1/filedrop/) accepts any mimeType without validation, including image/svg+xml, text/html, and application/javascript. An attacker with repository write access can upload a malicious SVG file containing JavaScript, create a build referencing the fileid, and obtain an archiveurl that serves the SVG through the CDN. When a victim visits the archive URL, the browser renders the SVG inline and executes the embedded JavaScript. The malicious SVG is stored in the object storage backend and served through a legitimate Quay domain. However, session hijacking is not possible as the csrftoken session cookie is configured with HttpOnly and Secure attributes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2486194?
The severity of REDHAT-BUG-2486194 is medium, rated at 4.
How does the vulnerability REDHAT-BUG-2486194 allow exploitation?
REDHAT-BUG-2486194 allows exploitation through the filedrop endpoint accepting any mimeType, enabling malicious SVG files to be uploaded.
Who can exploit REDHAT-BUG-2486194?
An attacker with repository write access can exploit REDHAT-BUG-2486194.
What is the potential impact of REDHAT-BUG-2486194?
The potential impact of REDHAT-BUG-2486194 includes the ability to execute JavaScript contained in uploaded SVG files once referenced in a build.
What action should be taken to mitigate REDHAT-BUG-2486194?
To mitigate REDHAT-BUG-2486194, validation of mimeTypes at the filedrop endpoint needs to be implemented to restrict uploads to safe file types.