Improper sanitize of SVG files during content upload ('Cross-site Scripting') in sylius/sylius
Date: 2022-03
Affected: composer/Sylius/Sylius, composer/Sylius/Sylius, composer/Sylius/Sylius
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2022-24749
CWE: CWE-434
CWE-79
CWE-80
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

### Impact There is a possibility to upload an SVG file containing XSS code in the admin panel. In order to perform an XSS attack, the file itself has to be opened in a new card (or loaded outside of the IMG tag). The problem applies both to the files opened on the admin panel and shop pages. ### Patches The issue is fixed in versions: 1.9.10, 1.10.11, 1.11.2, and above. ### Workarounds If there is a need to upload an SVG image type, on-upload sanitization has to be added. The way to achieve this is to require a library that will do the trick: ``` composer require enshrined/svg-sanitize ``` The second step is all about performing a file content sanitization before writing it to the filesystem. It can be done by overwriting the service: ```php <?php declare(strict_types=1); namespace App\Uploader; use enshrined\svgSanitize\Sanitizer; use Gaufrette\Filesystem; use Sylius\Component\Core\Generator\ImagePathGeneratorInterface; use Sylius\Component\Core\Generator\UploadedImagePathGenerator; use Sylius\Component\Core\Model\ImageInterface; use Sylius\Component\Core\Uploader\ImageUploaderInterface; use Symfony\Component\HttpFoundation\File\File; use Webmozart\Assert\Assert; final class ImageUploader implements ImageUploaderInterface { private const MIME_SVG_XML = 'image/svg+xml'; private const MIME_SVG = 'image/svg'; /** @var Filesystem */ protected $filesystem; /** @var ImagePathGeneratorInterface */ protected $imagePathGenerator; /** @var Sani


Mitigations:

Architectural layers (MAESTRO):