CVE-2023-27489
📋 TL;DR
Kiwi TCMS versions before 12.1 are vulnerable to cross-site scripting (XSS) via malicious SVG file uploads. When users upload SVG files containing JavaScript and view them directly (not embedded in HTML), the JavaScript executes in their browser. This affects all Kiwi TCMS instances with SVG upload functionality enabled.
💻 Affected Systems
- Kiwi TCMS
📦 What is this software?
Kiwi Tcms by Kiwitcms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies, performing actions as authenticated users, or redirecting to malicious sites.
Likely Case
Attackers upload malicious SVG files, trick users into viewing them, and steal session tokens or perform limited actions within the application.
If Mitigated
With proper Content-Security-Policy headers, modern browsers block inline JavaScript execution, preventing exploitation.
🎯 Exploit Status
Exploitation requires authenticated user access to upload SVG files and social engineering to get victims to view them directly.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.1
Vendor Advisory: https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2wcr-87wf-cf9j
Restart Required: Yes
Instructions:
1. Backup your Kiwi TCMS instance. 2. Upgrade to version 12.1 or later. 3. Restart the Kiwi TCMS service. 4. Verify the Content-Security-Policy header is present in HTTP responses.
🔧 Temporary Workarounds
Manual Content-Security-Policy Header
allConfigure your web server or reverse proxy to add Content-Security-Policy header blocking inline JavaScript.
For nginx: add_header Content-Security-Policy "default-src 'self'; script-src 'self';" always;
For Apache: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
For IIS: Add custom HTTP response header with name Content-Security-Policy and value default-src 'self'; script-src 'self'
🧯 If You Can't Patch
- Disable SVG file upload functionality in Kiwi TCMS configuration.
- Implement web application firewall (WAF) rules to block SVG files containing JavaScript patterns.
🔍 How to Verify
Check if Vulnerable:
Check if Kiwi TCMS version is below 12.1 and if SVG uploads are enabled. Test by uploading an SVG file with JavaScript content and viewing it directly.Check Version:
Check Kiwi TCMS web interface admin panel or run: docker exec kiwi_tcms python -c "import tcms; print(tcms.__version__)"Verify Fix Applied:
After upgrade, verify HTTP responses include Content-Security-Policy header. Test SVG upload with JavaScript - it should not execute when viewed directly.📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads from single users
- Multiple failed SVG upload attempts
- Requests to directly view uploaded SVG files
Network Indicators:
- HTTP requests for SVG files with suspicious parameters
- Lack of Content-Security-Policy headers in responses
SIEM Query:
source="kiwi_tcms" AND (event="file_upload" AND file_extension="svg") | stats count by user🔗 References
- https://github.com/kiwitcms/Kiwi/commit/6617cee0fb70cc394b7be6bbc86ef84e6e9de077
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2wcr-87wf-cf9j
- https://github.com/kiwitcms/Kiwi/commit/6617cee0fb70cc394b7be6bbc86ef84e6e9de077
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2wcr-87wf-cf9j
