HeyForm Unauthenticated File Upload Vulnerability Leading to Stored Cross-Site Scripting

A stored cross-site scripting vulnerability has been identified in HeyForm, an open-source form builder, prior to version 3.0.0-rc.7. The issue arises from the '/api/upload' endpoint, which allows unauthenticated file uploads, including SVG files. These uploaded SVGs are stored in the static assets directory and served with 'Content-Type: image/svg+xml' by Express's serve-static middleware. This misconfiguration enables an attacker to execute embedded JavaScript on the HeyForm domain without any authentication.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded SVG files execute embedded JavaScript in the context of the user viewing the file, potentially leading to session hijacking and account takeover.

Reproduction

To reproduce this vulnerability, upload a malicious SVG file containing JavaScript into the '/api/upload' endpoint without authentication. The uploaded file will be served as a static asset with the 'image/svg+xml' content type, which browsers interpret as an image but will execute any embedded scripts. After uploading, the file can be accessed through the static upload URL, where the JavaScript will execute in the context of the user.

Remediation

Users can update to HeyForm version 3.0.0-rc.7 or later, where this vulnerability has been patched.