Stored XSS in upload files

Stored XSS in upload files

Impact

Users are allowed to send compromised files, these attachments allowed people to input malicious JavaScript which triggered XSS payload

Patches

The problem is fixed in 1.7.6.8

Workarounds

With apache

In your .htaccess file `` <FilesMatch "\.pdf$"> Header set Content-Disposition "Attachment" Header set X-Content-Type-Options "nosniff" </FilesMatch> ``

In your /upload/.htaccess file `` <IfModule mod_headers.c> Header set Content-Disposition "Attachment" Header set X-Content-Type-Options "nosniff" </IfModule> ``

With Nginx

``` location ~* \.pdf$ { add_header Content-Disposition Attachment; add_header X-Content-Type-Options nosniff; }

location ~ ^/upload/ { add_header Content-Disposition Attachment; add_header X-Content-Type-Options nosniff; } ```

References

Cross-site Scripting (XSS) - Stored (CWE-79)