Executive brief
Apostrophe CMS, a content management system used to create and manage website content, contains a vulnerability where editors can upload SVG image files containing malicious scripts. When these compromised files are viewed within the media library, the embedded JavaScript executes in the browser, potentially allowing attackers to steal session tokens, modify content, or compromise administrator accounts.
Technical details
This is a stored XSS vulnerability (CWE-79) in Apostrophe CMS's SVG file upload handler. The vulnerability exists because uploaded SVG files are not sanitized to remove embedded JavaScript before being stored and served. An authenticated user with upload permissions can craft a malicious SVG containing XSS payloads; when opened via the media library's direct link feature, the JavaScript executes in the context of the user's browser. While typical SVG display via `img` tags would not trigger the payload, direct file access bypasses this protection. The attack requires authentication (editor-level access) and user interaction (viewing the file). The fix, released in version 3.3.2 and backported versions, sanitizes all SVG uploads using DOMPurify and retroactively sanitizes previously uploaded files during deployment.
Affected products
- Apostrophe Apostrophe CMS 2.63.0 to 3.3.1
Timeline
- 2021-11-10: disclosed
- 2021-09-07: patched: Fix released in version 3.3.2