Executive brief
Kiwi TCMS is a web-based test case management system that allows users to upload attachments to test plans and cases. Due to insufficient file upload validation and improper HTTP header handling in reverse proxy configurations, attackers can upload malicious files containing JavaScript code that executes in users' browsers when the files are accessed, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.
Technical details
This vulnerability combines unrestricted file upload (CWE-434) and stored cross-site scripting (CWE-79). The root cause is twofold: (1) file upload validation checks could be circumvented to upload dangerous files, and (2) Nginx's proxy_pass directive strips HTTP headers that Kiwi TCMS relies on for content-security-policy protections when deployed behind a reverse proxy. An attacker without authentication can upload a malicious file containing JavaScript to test plans or test cases. When other users access the uploaded file through their browsers, the arbitrary JavaScript executes in their context. The vulnerability requires user interaction (clicking the uploaded file link). Patches were released in version 12.4 with improved file upload validation and updated Nginx proxy configuration guidance.
Affected products
- Kiwi TCMS Kiwi TCMS <=12.3; fixed in 12.4
Timeline
- 2023-06-06: disclosed
- 2023-06-06: patched: Version 12.4 released