VYPR
← All advisories
High severityNVD Advisory· Published Jul 5, 2023· Updated Oct 24, 2024

Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox

CVE-2023-36809

Description

Kiwi TCMS, an open source test management system allows users to upload attachments to test plans, test cases, etc. Versions of Kiwi TCMS prior to 12.5 had introduced changes which were meant to serve all uploaded files as plain text in order to prevent browsers from executing potentially dangerous files when such files are accessed directly. The previous Nginx configuration was incorrect allowing certain browsers like Firefox to ignore the Content-Type: text/plain header on some occasions thus allowing potentially dangerous scripts to be executed. Additionally, file upload validators and parts of the HTML rendering code had been found to require additional sanitation and improvements. Version 12.5 fixes this vulnerability with updated Nginx content type configuration, improved file upload validation code to prevent more potentially dangerous uploads, and Sanitization of test plan names used in the tree_view_html() function.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
kiwitcmsPyPI
< 12.512.5

Affected products

1

Patches

2
195ea53eaaf3

Sanitize test plan name in tree_view_html()

https://github.com/kiwitcms/kiwiAlexander TodorovJun 30, 2023via ghsa
commit
1 file changed · +3 −1
  • tcms/testplans/models.py+3 −1 modified
    @@ -9,6 +9,7 @@
 
 from tcms.core.history import KiwiHistoricalRecords
 from tcms.core.models.base import UrlMixin
+from tcms.core.templatetags.extra_filters import bleach_input
 from tcms.management.models import Version
 from tcms.testcases.models import TestCasePlan
 
@@ -213,6 +214,7 @@ def tree_view_html(self):
             if test_plan.pk == self.pk:
                 active_class = "active"
 
+            plan_name = bleach_input(test_plan.name)
             result += f"""
                 <!-- begin-node -->
                 <div class="list-group-item {active_class}" style="border: none">
@@ -228,7 +230,7 @@ def tree_view_html(self):
                                 <div class="list-view-pf-description">
                                     <div class="list-group-item-text">
                                         <a href="{test_plan.get_absolute_url()}">
-                                            TP-{test_plan.pk}: {test_plan.name}
+                                            TP-{test_plan.pk}: {plan_name}
                                         </a>
                                     </div>
                                 </div>
ffb00450be52

Better enforcing of mime type for uploads

https://github.com/kiwitcms/kiwiAlexander TodorovJun 26, 2023via ghsa
commit
1 file changed · +2 −1
  • etc/nginx.conf+2 −1 modified
    @@ -84,7 +84,8 @@ http {
 
         location /uploads/  {
             # prevent browser from possibly interpreting untrusted files
-            add_header Content-Type "text/plain";
+            types        { }
+            default_type text/plain;
 
             alias /Kiwi/uploads/;
         }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.