Executive brief
Ech0, a Go-based application, is vulnerable to a security flaw where malicious files can be uploaded and then used to execute unauthorized scripts in a user's browser. An attacker with administrative privileges can upload specially crafted SVG or HTML files that, when viewed by other users or administrators, can steal login tokens, exfiltrate sensitive data, or hijack user sessions. This occurs because the system does not properly verify the contents of uploaded files and serves them publicly without adequate security protections.
Technical details
The file upload handler in `internal/service/file/file.go` validates the `Content-Type` using only the client-provided multipart header without server-side inspection or extension validation. Because `image/svg+xml` is allowed by default and the application serves files via `gin.Static` without `X-Content-Type-Options: nosniff` or a Content Security Policy (CSP), attackers can upload SVG files containing malicious JavaScript. Additionally, attackers can bypass type restrictions by spoofing the `Content-Type` header (e.g., sending an `.html` file as `image/jpeg`), as the server preserves the original file extension and determines the response MIME type based on that extension. Successful exploitation allows for stored XSS in the application's origin, enabling session hijacking and data exfiltration. The vulnerability is patched in version 4.4.3.
Affected products
- lin-snow ech0 < 4.4.3
Timeline
- 2026-04-09: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched: Fixed in version 4.4.3