CSV-Import allows arbitrary ﬁle uploads #61

New issue

Closed

opened 2025-01-29 11:22:09 +01:00 by hansegucker · 7 comments

hansegucker commented

2025-01-29 11:22:09 +01:00

(Migrated from edugit.org)

CLN-009 — CSV-Import allows arbitrary ﬁle uploads

Vulnerability ID: CLN-009

Vulnerability type: File Upload

Threat level: Low

Description:

Arbitrary files can be uploaded through the CSV-Import app.

Technical description:

The CSV-Import app allows users to import site data using a .zip file containing .csv files and corresponding image
files for user Avatars and photos. Elsewhere in AlekSIS, photo uploads are subject to file validation filters to prevent
users from uploading other file types. However, the CSV-Import app does not perform any validation on attached image
files and arbitrary file types can be uploaded.
AlekSIS will attempt to render files as images when referenced in user avatars or photos via img src= or as the
background of a CSS element. An HTML file containing malicious Javascript can be uploaded in this way, but this file will
only be loaded by a user (as in a cross-site scripting attack) if the user searches out the direct link in the page source. In
testing we were unable to meaningfully exploit this arbitrary file upload.

Impact:

The CSV-Import mechanism is bypassing the controls on image upload that are employed elsewhere in AlekSIS.
Future features or other untested AlekSIS apps may be exploitable if these uploaded files are linked to or included
in ways that enable cross-site scripting attacks.

Recommendation:

CSV-Import should properly validate files included as images and exclude non-image files. See OWASP Arbitry Upload documentation for more information.

# CLN-009 — CSV-Import allows arbitrary ﬁle uploads Vulnerability ID: CLN-009 Vulnerability type: File Upload Threat level: Low ## Description: Arbitrary files can be uploaded through the CSV-Import app. ## Technical description: The CSV-Import app allows users to import site data using a .zip file containing .csv files and corresponding image files for user Avatars and photos. Elsewhere in AlekSIS, photo uploads are subject to file validation filters to prevent users from uploading other file types. However, the CSV-Import app does not perform any validation on attached image files and arbitrary file types can be uploaded. AlekSIS will attempt to render files as images when referenced in user avatars or photos via img src= or as the background of a CSS element. An HTML file containing malicious Javascript can be uploaded in this way, but this file will only be loaded by a user (as in a cross-site scripting attack) if the user searches out the direct link in the page source. In testing we were unable to meaningfully exploit this arbitrary file upload. ## Impact: * The CSV-Import mechanism is bypassing the controls on image upload that are employed elsewhere in AlekSIS. * Future features or other untested AlekSIS apps may be exploitable if these uploaded files are linked to or included in ways that enable cross-site scripting attacks. ## Recommendation: * CSV-Import should properly validate files included as images and exclude non-image files. See OWASP Arbitry Upload documentation for more information.

hansegucker commented

2025-01-29 11:22:10 +01:00

(Migrated from edugit.org)

assigned to @yuha

hansegucker commented

2025-01-29 22:57:41 +01:00

(Migrated from edugit.org)

Action to take: Ensure that model validation runs (full_clean, https://docs.djangoproject.com/en/5.1/ref/models/instances/#django.db.models.Model.full_clean), this should also check files

Action to take: Ensure that model validation runs (`full_clean`, https://docs.djangoproject.com/en/5.1/ref/models/instances/#django.db.models.Model.full_clean), this should also check files

hansegucker commented

2025-02-15 22:17:39 +01:00

(Migrated from edugit.org)

assigned to @hansegucker and unassigned @yuha

hansegucker commented

2025-02-15 22:17:56 +01:00

(Migrated from edugit.org)

made the issue visible to everyone

hansegucker commented

2025-02-15 22:18:00 +01:00

(Migrated from edugit.org)

created branch 61-csv-import-allows-arbitrary-le-uploads to address this issue

created branch [`61-csv-import-allows-arbitrary-le-uploads`](/AlekSIS/official/AlekSIS-App-CSVImport/-/compare/master...61-csv-import-allows-arbitrary-le-uploads) to address this issue

hansegucker commented

2025-02-15 22:19:05 +01:00

(Migrated from edugit.org)

mentioned in merge request !253

hansegucker (Migrated from edugit.org) closed this issue

2025-02-15 22:21:26 +01:00

hansegucker commented

2025-02-15 22:21:42 +01:00

(Migrated from edugit.org)

mentioned in commit 1f5ec35cdd

mentioned in commit 1f5ec35cdd0352b94f42a0d66f3f16da93a2eb93