CVE-2020-29071
📋 TL;DR
This cross-site scripting (XSS) vulnerability in LiquidFiles allows attackers to execute malicious scripts when users access specially crafted HTML attachments via the -htmlview URL. The impact can range from stealing sensitive email data to gaining root access on the server, depending on the victim's permissions. All LiquidFiles users with the Shares feature enabled are affected.
💻 Affected Systems
- LiquidFiles
📦 What is this software?
Liquidfiles by Liquidfiles
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains root access on the LiquidFiles server, potentially compromising the entire system and all encrypted email data.
Likely Case
Attacker steals session cookies, authentication tokens, or sensitive email content from users who access malicious HTML attachments.
If Mitigated
Limited to stealing session data from users who click on malicious links, assuming proper network segmentation and user awareness training.
🎯 Exploit Status
Exploitation requires a user to access a malicious HTML attachment via the vulnerable -htmlview endpoint. Public advisory includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.19
Vendor Advisory: https://man.liquidfiles.com/release_notes/version_3-3-x.html
Restart Required: Yes
Instructions:
1. Backup your LiquidFiles configuration and data. 2. Download version 3.3.19 or later from the official LiquidFiles website. 3. Follow the upgrade instructions for your deployment method (appliance, Docker, or manual). 4. Restart the LiquidFiles service.
🔧 Temporary Workarounds
Disable HTML file viewing
allTemporarily disable the -htmlview functionality or block access to HTML attachments in the Shares feature
Configuration depends on deployment method. Check LiquidFiles admin interface for content filtering options.
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to prevent script execution
- Use web application firewall (WAF) rules to block malicious HTML content and monitor for XSS attempts
🔍 How to Verify
Check if Vulnerable:
Check if LiquidFiles version is below 3.3.19 in the admin interface or via system commandsCheck Version:
Check admin dashboard or run: cat /opt/liquidfiles/version.txt (path may vary)Verify Fix Applied:
Confirm version is 3.3.19 or higher and test that HTML attachments no longer execute scripts when accessed via -htmlview📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to -htmlview URLs
- Multiple failed attempts to upload or access HTML files
Network Indicators:
- Suspicious HTML file uploads followed by immediate -htmlview access requests
SIEM Query:
source="liquidfiles" AND (url="*htmlview*" OR file_extension="html") | stats count by src_ip, user