aleksis/AlekSIS-App-CSVImport

Watch

Fork 0

CSV-Import allows arbitrary ﬁle uploads #61

New issue

Closed

opened 2025-01-29 11:22:09 +01:00 by hansegucker · 7 comments

hansegucker commented

2025-01-29 11:22:09 +01:00

Owner

CLN-009 — CSV-Import allows arbitrary ﬁle uploads

Vulnerability ID: CLN-009

Vulnerability type: File Upload

Threat level: Low

Description:

Arbitrary files can be uploaded through the CSV-Import app.

Technical description:

The CSV-Import app allows users to import site data using a .zip file containing .csv files and corresponding image
files for user Avatars and photos. Elsewhere in AlekSIS, photo uploads are subject to file validation filters to prevent
users from uploading other file types. However, the CSV-Import app does not perform any validation on attached image
files and arbitrary file types can be uploaded.
AlekSIS will attempt to render files as images when referenced in user avatars or photos via img src= or as the
background of a CSS element. An HTML file containing malicious Javascript can be uploaded in this way, but this file will
only be loaded by a user (as in a cross-site scripting attack) if the user searches out the direct link in the page source. In
testing we were unable to meaningfully exploit this arbitrary file upload.

Impact:

The CSV-Import mechanism is bypassing the controls on image upload that are employed elsewhere in AlekSIS.
Future features or other untested AlekSIS apps may be exploitable if these uploaded files are linked to or included
in ways that enable cross-site scripting attacks.

Recommendation:

CSV-Import should properly validate files included as images and exclude non-image files. See OWASP Arbitry Upload documentation for more information.

# CLN-009 — CSV-Import allows arbitrary ﬁle uploads Vulnerability ID: CLN-009 Vulnerability type: File Upload Threat level: Low ## Description: Arbitrary files can be uploaded through the CSV-Import app. ## Technical description: The CSV-Import app allows users to import site data using a .zip file containing .csv files and corresponding image files for user Avatars and photos. Elsewhere in AlekSIS, photo uploads are subject to file validation filters to prevent users from uploading other file types. However, the CSV-Import app does not perform any validation on attached image files and arbitrary file types can be uploaded. AlekSIS will attempt to render files as images when referenced in user avatars or photos via img src= or as the background of a CSS element. An HTML file containing malicious Javascript can be uploaded in this way, but this file will only be loaded by a user (as in a cross-site scripting attack) if the user searches out the direct link in the page source. In testing we were unable to meaningfully exploit this arbitrary file upload. ## Impact: * The CSV-Import mechanism is bypassing the controls on image upload that are employed elsewhere in AlekSIS. * Future features or other untested AlekSIS apps may be exploitable if these uploaded files are linked to or included in ways that enable cross-site scripting attacks. ## Recommendation: * CSV-Import should properly validate files included as images and exclude non-image files. See OWASP Arbitry Upload documentation for more information.

hansegucker commented

2025-01-29 11:22:10 +01:00

Author

Owner

assigned to @yuha

hansegucker commented

2025-01-29 22:57:41 +01:00

Author

Owner

Action to take: Ensure that model validation runs (full_clean, https://docs.djangoproject.com/en/5.1/ref/models/instances/#django.db.models.Model.full_clean), this should also check files

Action to take: Ensure that model validation runs (`full_clean`, https://docs.djangoproject.com/en/5.1/ref/models/instances/#django.db.models.Model.full_clean), this should also check files

hansegucker commented

2025-02-15 22:17:39 +01:00

Author

Owner

assigned to @hansegucker and unassigned @yuha

hansegucker commented

2025-02-15 22:17:56 +01:00

Author

Owner

made the issue visible to everyone

hansegucker commented

2025-02-15 22:18:00 +01:00

Author

Owner

created branch 61-csv-import-allows-arbitrary-le-uploads to address this issue

created branch [`61-csv-import-allows-arbitrary-le-uploads`](/AlekSIS/official/AlekSIS-App-CSVImport/-/compare/master...61-csv-import-allows-arbitrary-le-uploads) to address this issue

hansegucker commented

2025-02-15 22:19:05 +01:00

Author

Owner

mentioned in merge request !253

hansegucker closed this issue

2025-02-15 22:21:26 +01:00

hansegucker commented

2025-02-15 22:21:42 +01:00

Author

Owner

mentioned in commit 1f5ec35cdd