ghsa-fwcf-753v-fgcj
Vulnerability from github
Published
2023-04-24 22:44
Modified
2023-04-24 22:44
Severity ?
7.7 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Summary
Unrestricted file upload in kiwi TCMS
Details

Impact

Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. In earlier versions there is no control over what kinds of files can be uploaded. Thus a malicious actor may upload an .exe file or a file containing embedded JavaScript and trick others into clicking on these files causing vulnerable browsers to execute malicious code on another computer or attempting XSS attacks.

Stored XSS attacks via file uploads have been fixed in earlier versions of Kiwi TCMS, see GHSA-2wcr-87wf-cf9j. This advisory deals with prohibiting users to upload potentially compromised files in the first place.

Patches

Kiwi TCMS v12.2 comes with functionality that allows administrators to configure additional upload validator functions which give them more control over what file types are accepted for upload. By default .exe are denied. Other files containing the <script> tag, regardless of their type are also denied b/c they are a path to XSS attacks.

Workarounds

Upgrade to version 12.2 or later.

References

Originally reported by Ahmed Rabeaa Mosaa.

Show details on source website

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "kiwitcms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-30613"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-24T22:44:12Z",
    "nvd_published_at": "2023-04-24T17:15:10Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nKiwi TCMS allows users to upload attachments to test plans, test cases, etc. In earlier versions there is no control over what kinds of files can be uploaded. Thus a malicious actor may upload an `.exe` file or a file containing embedded JavaScript and trick others into clicking on these files causing vulnerable browsers to execute malicious code on another computer or attempting XSS attacks.\n\nStored XSS attacks via file uploads have been fixed in earlier versions of Kiwi TCMS, see [GHSA-2wcr-87wf-cf9j](https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2wcr-87wf-cf9j). This advisory deals with prohibiting users to upload potentially compromised files in the first place.\n\n\n### Patches\nKiwi TCMS v12.2 comes with functionality that allows administrators to configure additional upload validator functions which give them more control over what file types are accepted for upload. By default `.exe` are denied. Other files containing the `\u003cscript\u003e` tag, regardless of their type are also denied b/c they are a path to XSS attacks.\n\n\n\n### Workarounds\nUpgrade to version 12.2 or later.\n\n### References\nOriginally reported by [Ahmed Rabeaa Mosaa](https://huntr.dev/bounties/c30d3503-600d-4d00-9571-98826a51f12c).",
  "id": "GHSA-fwcf-753v-fgcj",
  "modified": "2023-04-24T22:44:12Z",
  "published": "2023-04-24T22:44:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30613"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kiwitcms/Kiwi"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/c30d3503-600d-4d00-9571-98826a51f12c"
    },
    {
      "type": "WEB",
      "url": "https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Unrestricted file upload in kiwi TCMS"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.