Authentik Stored Cross-Site Scripting Vulnerability via SVG File Upload

A stored cross-site scripting vulnerability has been identified in the Authentik project, affecting all versions prior to 2024.10.4. This issue allows authenticated admin users to upload manipulated SVG files that are then used as application icons. When other users click on these icons, the embedded scripts in the SVG files are executed in their browsers.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user who clicks on the affected icon.

Reproduction

To reproduce this vulnerability, an authenticated admin user can upload a crafted SVG file containing JavaScript into the application icons. After the file is uploaded, the script will execute in the browser of any user who clicks on the icon.

Remediation

Users can update to Authentik version 2024.10.4 or later, where this vulnerability has been fixed.