I uploaded a green square to a Next.js store and got stored XSS

In OopsSec Store, an admin panel allows uploading product images, including SVGs. Because SVG files are XML, malicious JavaScript can be embedded within them. By uploading a malicious SVG containing a script tag, an attacker can execute JavaScript code in the browsers of every visitor who views the infected product page. Two ways to gain admin access include SQL injection to obtain the admin password hash or weak MD5 hashing to crack the admin password.

To reproduce this exploit, first set up OopsSec Store using either Node.js or Docker. Log in as an admin and navigate to the admin product image editor. Create an SVG file with a script tag that displays an alert message, then upload it to a product. Once uploaded, the stored XSS attack will trigger, executing the malicious JavaScript for all visitors.

The server initially validates the file type based on the Content-Type header, which the attacker can manipulate easily. The frontend then renders the SVG using the object tag, which, unlike an img tag, allows the embedded script to run.

To remediate the vulnerability, ensure the server inspects the actual file bytes rather than relying solely on the Content-Type header. This step alone would prevent the malicious SVG from executing JavaScript. Additionally, maintain a whitelist of allowed file types and implement content scanning to ensure only safe file formats are accepted.