Stored Cross-Site Scripting in Agentejo Cockpit CMS

Agentejo Cockpit CMS versions up to and including 2.6.3 are susceptible to a stored Cross-Site Scripting (XSS) vulnerability. The flaw exists within the file upload functionality of the CMS, specifically located at the assets/upload endpoint. An attacker with the ability to upload files can bypass the application's extension blacklisting mechanism to upload a file with an .shtml extension containing embedded malicious JavaScript. When a user subsequently accesses the URL of the uploaded file, the browser executes the embedded script within the context of the CMS application. This vulnerability is documented as CVE-2023-41564 and presents a risk of session hijacking, credential theft, or unauthorized actions performed on behalf of authenticated users.

Attack Chain

1. Attacker authenticates to the target Cockpit CMS instance with a user account authorized to upload assets.
2. Attacker crafts a malicious .shtml file containing a JavaScript payload.
3. Attacker sends a POST request to the /assets/upload endpoint containing the crafted .shtml file.
4. The server-side logic fails to properly sanitize or block the .shtml extension despite its blacklisting logic for other dangerous file types.
5. The server saves the file to the assets directory and returns the file path to the attacker.
6. Attacker distributes the URL of the uploaded .shtml asset to a target user, often through social engineering or by placing it where users are likely to interact with it.
7. Target user visits the URL, causing the web browser to render the file and execute the malicious JavaScript payload in the user's session context.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of a victim's session, potentially leading to unauthorized data access, session token theft, or malicious actions within the CMS. The vulnerability affects all Cockpit CMS installations up to version 2.6.3.

Recommendation

Prioritize updating all instances of Cockpit CMS to a version beyond 2.6.3 that addresses the insecure file upload validation logic. As an immediate mitigation, implement strict ingress filtering at the Web Application Firewall (WAF) to block requests to /assets/upload that attempt to upload files with non-standard or dangerous extensions, specifically targeting .shtml and other server-side parsing extensions. Additionally, ensure that the server's MIME type handling and file upload policies are configured to enforce a whitelist-only approach for permitted file types, rather than relying solely on blacklists.