漏洞标题
Decidim 可能受到跨站脚本（XSS）攻击，目标是动态文件上传功能。
漏洞描述信息
Decidim是一个参与式民主框架。在版本0.27.0及之前的版本（除了0.27.5和0.28.0）中，动态文件上传功能存在潜在的跨站脚本攻击风险。如果攻击者能够修改正在上传到服务器的记录的文件名，那么就会出现这种情况。
这发生在用户自己控制文件上传对话框，并具备通过动态上传端点更改文件名的技术知识的情况下。
因此，我认为这需要攻击者控制特定用户的整个会话，但无论如何，这个问题需要解决。成功利用这个漏洞需要用户已经成功将恶意文件名的文件blob上传到服务器，然后有机会引导其他用户访问包含附件的记录编辑页面。用户能够自己构造直接上传请求，控制存储到数据库中的文件名。如果攻击者知道如何自己构建这些请求，他们就可以更改文件名，例如改为`<svg onload=alert('XSS')>)`。
然后通过手动修改编辑页面的源代码，输入返回的blob ID到表单输入框中作为工作流绕过方法。版本0.27.5和0.28.0包含这个漏洞的补丁。作为一种临时解决方案，可以禁用实例上的动态上传功能，例如从提案中禁用。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
漏洞类别
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
漏洞标题
Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploads
漏洞描述信息
Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload feature is subject to potential cross-site scripting attacks in case the attacker manages to modify the file names of the records being uploaded to the server. This appears in sections where the user controls the file upload dialogs themselves and has the technical knowledge to change the file names through the dynamic upload endpoint. Therefore I believe it would require the attacker to control the whole session of the particular user but in any case, this needs to be fixed. Successful exploit of this vulnerability would require the user to have successfully uploaded a file blob to the server with a malicious file name and then have the possibility to direct the other user to the edit page of the record where the attachment is attached. The users are able to craft the direct upload requests themselves controlling the file name that gets stored to the database. The attacker is able to change the filename e.g. to `<svg onload=alert('XSS')>` if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually by modifying the edit page source. Versions 0.27.5 and 0.28.0 contain a patch for this issue. As a workaround, disable dynamic uploads for the instance, e.g. from proposals.
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
漏洞类别
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
漏洞标题
Decidim 跨站脚本漏洞
漏洞描述信息
Decidim是一个参与式民主框架，用 Ruby on Rails 编写。 Decidim 0.27.0版本至0.27.5版本、0.28.0版本存在跨站脚本漏洞，该漏洞源于动态文件上传功能中存在跨站脚本漏洞。
CVSS信息
N/A
漏洞类别
跨站脚本