CVE-2024-12326 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau

Medium 6.1 Published 6 Dec 2024 Updated 30 Dec 2024

Attackers can execute arbitrary scripts via manipulated SVG uploads by bypassing case-sensitive MIME type checks in Jirafeau.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2024-12326?

CVE-2024-12326 is a medium-severity cross-site scripting vulnerability in Jirafeau, published on 6 Dec 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Jirafeau normally prevents browser preview for SVG files due to the possibility that manipulated SVG files could be exploited for cross site scripting. This was done by storing the MIME type of a file and preventing the browser preview for MIME type image/svg+xml. This issue was first reported in CVE-2022-30110. However, it was still possible to do a browser preview of a SVG file by sending a manipulated MIME type during the upload, where the case of any letter in image/svg+xml had been changed (like image/svg+XML). The check for image/svg+xml has been changed to be case insensitive.

Weakness: CWE-79

Which versions are affected by CVE-2024-12326?

It affects 1 product.

Products include Jirafeau Jirafeau.

How do I fix CVE-2024-12326?

No fix has been published for CVE-2024-12326 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-12326 being exploited?

There is no known exploitation of CVE-2024-12326 in the wild and no public exploit code.

Sources

Also known as GHSA-hxm9-p924-7mqf.