Horizon Alert
Summary of the vulnerability and why it matters
This advisory details a vulnerability in BookStack that could allow an attacker with editor privileges to inject malicious scripts. When an administrator views certain uploaded images, these scripts could execute within their browser. The main concern is confirming if this specific technology is in use within your environment.
- A scripting flaw exists in image uploads.
- Attackers can execute code in admin browsers.
- Confirm relevance and exposure for BookStack.
Attack Path
How an attacker could exploit the issue
An attacker with editor permissions can upload malicious SVG files through the drawing upload feature. If these files are viewed through the image gallery API, embedded scripts can execute in the browsers of users with administrator privileges.
- Requires editor permissions.
- Uploading malicious SVG via drawing endpoint.
- Executing scripts in admin browsers.
Live Threat
Current exploitation, exposure, and threat context
When an attacker with editor permissions uploads a malicious SVG file, scripts embedded within it could execute within administrator browsers when the image gallery API is accessed without proper validation. This could impact sensitive information displayed in the administrator's browser.
- Administrator browser sessions could be compromised.
- Malicious scripts execute when gallery is viewed.
- Sensitive data in browser may be exposed.
Operational Fix
Recommended remediation, mitigation, and detection steps
BookStack administrators are likely responsible for addressing this stored cross-site scripting vulnerability. The first practical step is to identify all BookStack instances, confirm their reachability and criticality, and then coordinate with the application or platform owners for remediation planning.
- Application or platform owners should own.
- Verify all BookStack instances are identified.
- Plan remediation based on exposure risk.
