CVE-2022-24588

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in Flatpress v1.2.1 within the Upload SVG File function. The application fails to properly sanitize or validate SVG files containing JavaScript payloads during upload, allowing an attacker to store malicious code in the server's file system [1][2]. This issue affects the default configuration as the upload functionality is accessible to authenticated users.

Exploitation

An attacker with the ability to upload files (typically an authenticated user with upload privileges) can craft a malicious SVG file containing embedded JavaScript. The attacker uploads this SVG file via the vulnerable function; when the file is later accessed or rendered by a victim (e.g., via direct URL or inclusion in a page), the script executes in the victim's browser session [1][2]. No user interaction beyond viewing the file is required for exploitation.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browsing session. This can lead to session hijacking, defacement, or exfiltration of sensitive data (such as cookies or page content) depending on the attacker's payload. The attack does not affect the server-side environment but compromises the integrity and confidentiality of end-user interactions with the Flatpress instance [1][2].

Mitigation

As of the publication date (2022-02-15), no official patch or updated version was available for Flatpress v1.2.1. Users should avoid uploading SVG files from untrusted sources, implement file type validation and strict sanitization of SVG content, or disable the SVG upload capability altogether until a fix is released [1][2].