CVE-2022-30999
📋 TL;DR
This vulnerability allows attackers to execute arbitrary JavaScript code by uploading malicious SVG files to FoF Upload extension for Flarum forums. Authenticated users can exploit this to leak or modify data through cross-site scripting attacks. All Flarum installations using FoF Upload versions before 1.2.3 with SVG uploads enabled are affected.
💻 Affected Systems
- FriendsOfFlarum Upload extension for Flarum
📦 What is this software?
Upload by Friendsofflarum
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of forum data including user credentials, private messages, and administrative access through JavaScript execution in victim browsers.
Likely Case
Data exfiltration from authenticated users' sessions, potential account takeover, and unauthorized data modification.
If Mitigated
Limited impact with proper input validation and SVG sanitization in place.
🎯 Exploit Status
Exploitation requires authenticated user access and SVG upload capability
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.3
Vendor Advisory: https://github.com/FriendsOfFlarum/upload/security/advisories/GHSA-fm53-mpmp-7qw2
Restart Required: No
Instructions:
1. Update FoF Upload extension to version 1.2.3 or later via Flarum admin panel or Composer. 2. Verify SVG sanitization is enabled in extension settings.
🔧 Temporary Workarounds
Disable SVG uploads
allRemove SVG file type from allowed upload formats in FoF Upload configuration
🧯 If You Can't Patch
- Implement web application firewall rules to block SVG file uploads
- Add Content Security Policy headers to restrict script execution from uploaded files
🔍 How to Verify
Check if Vulnerable:
Check FoF Upload extension version in Flarum admin panel or composer.json. If version < 1.2.3 and SVG uploads are enabled, system is vulnerable.Check Version:
composer show fof/upload --format=json | grep versionVerify Fix Applied:
Verify extension version is 1.2.3 or higher and test SVG upload functionality with embedded scripts to confirm sanitization.📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads
- Multiple failed SVG upload attempts
- Requests to uploaded SVG files with suspicious parameters
Network Indicators:
- Outbound connections from forum to external domains following SVG file access
- Unusual POST requests containing SVG content
SIEM Query:
source="web_logs" AND (uri="*.svg" OR mime_type="image/svg+xml") AND status=200🔗 References
- https://github.com/FriendsOfFlarum/upload/issues/68
- https://github.com/FriendsOfFlarum/upload/pull/318
- https://github.com/FriendsOfFlarum/upload/releases/tag/1.2.3
- https://github.com/FriendsOfFlarum/upload/security/advisories/GHSA-fm53-mpmp-7qw2
- https://github.com/FriendsOfFlarum/upload/issues/68
- https://github.com/FriendsOfFlarum/upload/pull/318
- https://github.com/FriendsOfFlarum/upload/releases/tag/1.2.3
- https://github.com/FriendsOfFlarum/upload/security/advisories/GHSA-fm53-mpmp-7qw2
