CVE-2022-1345
📋 TL;DR
This vulnerability allows attackers to upload malicious SVG files containing JavaScript to the Organizr web application, which then executes in users' browsers when viewed. It affects all users of Organizr versions prior to 2.1.1810. Successful exploitation can lead to session hijacking, data theft, and complete compromise of user accounts.
💻 Affected Systems
- Organizr
📦 What is this software?
Organizr by Organizr
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access, steal all user sessions and credentials, modify application data, and establish persistent backdoors.
Likely Case
Session hijacking leading to unauthorized access to user accounts, data exfiltration, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and file upload restrictions, potentially only affecting individual user sessions.
🎯 Exploit Status
Exploitation requires user interaction (viewing the malicious SVG) but the attack vector is simple and well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.1810
Vendor Advisory: https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a
Restart Required: Yes
Instructions:
1. Backup your current Organizr installation. 2. Update to version 2.1.1810 or later via git pull or manual download. 3. Restart the Organizr service. 4. Verify the fix by checking the version.
🔧 Temporary Workarounds
Disable SVG uploads
allConfigure Organizr to block SVG file uploads entirely
Modify Organizr configuration to remove 'svg' from allowed file types
Implement Content Security Policy
allAdd CSP headers to prevent script execution from uploaded files
Add 'Content-Security-Policy: default-src 'self'; script-src 'self'' to web server configuration
🧯 If You Can't Patch
- Disable file upload functionality completely in Organizr settings
- Implement WAF rules to block SVG files with script tags and monitor for upload attempts
🔍 How to Verify
Check if Vulnerable:
Check if Organizr version is below 2.1.1810 in the web interface or configuration filesCheck Version:
Check Organizr web interface dashboard or config.php for version informationVerify Fix Applied:
Confirm version is 2.1.1810 or higher and test SVG upload with script tags (should be blocked or sanitized)📡 Detection & Monitoring
Log Indicators:
- SVG file uploads containing script tags, JavaScript execution in file upload logs
- Unusual user activity following file uploads
Network Indicators:
- HTTP POST requests with SVG files containing script content
- Outbound connections to suspicious domains after SVG upload
SIEM Query:
source="organizr.log" AND ("svg" AND ("script" OR "javascript" OR "onload"))