Outline Local File Storage CSP Bypass Vulnerability

A vulnerability exists in Outline versions 0.72.0 through 0.83.0, allowing a Content Security Policy (CSP) bypass through the local file storage feature. When self-hosted with FILE_STORAGE set to local, a malicious payload can be uploaded as a file attachment, bypassing CSP restrictions and enabling script execution in the context of another user.

Impact

Exploitation of this vulnerability allows for a CSP bypass and ContentType bypass, potentially leading to unauthorized script execution within another user's context.

Remediation

Users can upgrade to Outline version 0.84.0, which includes the necessary CSP protections. Alternatively, self-hosted instances can apply a workaround by ensuring the 'files.get' endpoint responses include the 'Content-Security-Policy: sandbox' header, using a proxy in front of Outline.