ThingsBoard Stored Cross-Site Scripting Vulnerability via Malicious SVG Image Upload

A stored cross-site scripting vulnerability has been identified in ThingsBoard versions prior to 4.2.1. This issue allows authenticated users to upload harmful SVG images through the 'Image Gallery'. The vulnerability arises because the 'ImageController' does not properly sanitize JavaScript execution when images are loaded in users' browsers. Exploitation can occur when the malicious SVGs are accessed via the public API or embedded in an 'iframe' during widget creation, deployment, and normal platform use. This flaw could enable the execution of harmful code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.

Impact

Exploitation of this vulnerability could lead to stored cross-site scripting, allowing for the execution of malicious scripts in the context of the affected user.

Remediation

Users can update to ThingsBoard version 4.2.1 or later, where this vulnerability has been addressed.