Server side cross-site scripting In github.com/forceu/gokapi
Description
Gokapi has Stored XSS in SVG Hotlinks
Summary
If a malicious authenticated user uploads SVG and creates a hotlink for it, they achieve stored XSS.
Details
The hotlinking functionality fails to properly handle scripts included in the SVGs, allowing authenticated attackers with the ability to upload and hotlink file to execute arbitrary JS.
Issue found by aisafe.io
Impact
Authenticated attackers with the ability to upload and hotlink files can execute arbitrary JavaScript.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 go | 2.2.3 |
Aliases
1. 2. 3. 4. 5.
References
1. 2.