CVE-2022-30999 Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
Attackers can execute arbitrary JavaScript via unsanitized SVG uploads in FoF Upload, potentially leaking or modifying user data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-30999?
CVE-2022-30999 is a high-severity cross-site scripting vulnerability in FriendsOfFlarum upload, published on 25 May 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously. This issue has been patched with v1.2.3, which now sanitizes uploaded SVG files. As a workaround, remove the ability for users to upload SVG files through FoF Upload.
Weakness: CWE-79
Which versions are affected by CVE-2022-30999?
2 open source packages ship an affected version, including fof/upload. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fof/upload Packagist | All versions | 1.2.3 |
fof/upload Packagist | All versions | 1.2.3 |
Products include Friendsofflarum Upload.
How do I fix CVE-2022-30999?
Upgrade fof/upload to 1.2.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-30999 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-30999 exists.
Sources
Also known as GHSA-fm53-mpmp-7qw2.