CVE-2024-3766

CVE-2024-3766 describes a stored cross-site scripting (XSS) vulnerability in the image file upload functionality of slowlyo OwlAdmin, affecting versions up to 3.5.7. The flaw exists in the /admin-api/upload_image endpoint, where insufficient validation of uploaded file contents permits the injection of malicious script code. An attacker can craft an image file containing payloads such as ` and, upon successful upload, the server returns a URL pointing to an HTML file served from the /storage/images/` directory, which executes the injected script in the browser of any user viewing that resource [1].

Exploitation

This attack can be performed remotely without authentication, as the upload endpoint is accessible to any user who can reach the application interface (the demo environment provides default admin credentials, but the vulnerability itself does not require authentication for initial upload). The attacker intercepts a legitimate image upload request, replaces the file content with the XSS payload, and submits the request. The subsequent stored file, when accessed via the returned URL, renders the script in the victim's browser context, leading to script execution [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to theft of sensitive data such as session tokens, cookies, and personal information, potentially resulting in account takeover or further compromise of the administrative interface. The stored nature of the XSS means that any user visiting the generated HTML page is affected, increasing the blast radius [1].

Mitigation

As of the publication date, a patch has not been released for this vulnerability. The vendor's recommended mitigation includes proper output encoding (e.g., escaping < as <) and strict validation/sanitization of uploaded file content to block script elements. Administrators should restrict access to the upload endpoint and consider using a Web Application Firewall (WAF) to detect and block malicious payloads until an official update is deployed [1].