CVE-2022-24833
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in PrivateBin where malicious SVG attachments containing JavaScript can execute arbitrary code when users interact with preview images. All PrivateBin instances running versions v0.21 through v1.3.x are affected unless protected by proper Content Security Policies.
💻 Affected Systems
- PrivateBin
📦 What is this software?
Privatebin by Privatebin
⚠️ Risk & Real-World Impact
Worst Case
Attackers can execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies, performing actions as the user, or redirecting to malicious sites.
Likely Case
Attackers create pastes with malicious SVG attachments that execute JavaScript when users preview them, leading to session hijacking or credential theft.
If Mitigated
With proper Content Security Policy headers, SVG JavaScript execution is blocked, preventing exploitation.
🎯 Exploit Status
Exploitation requires user interaction (clicking preview) but is straightforward once malicious SVG is uploaded.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.4.0
Vendor Advisory: https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-cqcc-mm6x-vmvw
Restart Required: Yes
Instructions:
1. Backup your PrivateBin instance. 2. Download PrivateBin v1.4.0 or later from GitHub. 3. Replace existing files with new version. 4. Restart web server. 5. Verify CSP headers are properly configured.
🔧 Temporary Workarounds
Implement Strict Content Security Policy
allConfigure web server to send CSP headers that block inline JavaScript and restrict SVG execution
Add to web server config: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:
🧯 If You Can't Patch
- Disable SVG attachments completely in PrivateBin configuration
- Implement WAF rules to block SVG files with JavaScript content
🔍 How to Verify
Check if Vulnerable:
Check PrivateBin version in admin interface or by examining source files. Versions below 1.4.0 are vulnerable.Check Version:
Check lib/Controller.php for version constant or view admin interfaceVerify Fix Applied:
After upgrade, verify version shows 1.4.0 or higher. Test by uploading SVG with JavaScript and confirming it doesn't execute.📡 Detection & Monitoring
Log Indicators:
- Multiple SVG file uploads from single IP
- Large SVG files with suspicious content patterns
- Unusual spike in paste creation
Network Indicators:
- HTTP requests for SVG files with JavaScript-like content in parameters
- Unusual outbound connections after SVG preview
SIEM Query:
source="webserver.log" AND (uri="/?pasteid=" OR uri MATCHES "*\.svg") AND (user_agent CONTAINS "script" OR referer CONTAINS "javascript:")🔗 References
- https://github.com/PrivateBin/PrivateBin/commit/2a4d572c1e9eb9b608d32b0cc0cb3b6c3b684eab
- https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-cqcc-mm6x-vmvw
- https://github.com/PrivateBin/PrivateBin/commit/2a4d572c1e9eb9b608d32b0cc0cb3b6c3b684eab
- https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-cqcc-mm6x-vmvw
