Stored XSS Vulnerability Found - Attachments Preview
**Affected feature:** Attachment upload / preview viewer\
**Severity (recommended):** **High** - stored cross-site scripting allowing arbitrary JS execution in other users browsers.
Summary
When an HTML file is uploaded as an attachment, the app’s preview renders it inline and executes any embedded JavaScript. This is a stored XSS: an attacker can upload an HTML payload that executes whenever another user opens the preview. That allows cookie/session theft, account takeover, UI manipulation, CSRF-like actions, and data exfiltration.
Note: Anyone who views these attachments will have the malicious JS execute in their browsers
Impact
* Remote execution of arbitrary JavaScript in the context of the web app for any user who previews the attachment.
* Potential account takeover (if session cookies are accessible), unauthorized actions, or disclosure of sensitive data.
* Since attachment is stored, attack persists until removed or fixed
Proof-Of-Concept
* Create a HTML Document with the following contents
{width=414 height=91}
* In Tryton, click the attachment button and "add"
* add the created HTML document with the payload
{width=880 height=255}
* Click the attachment and "preview"
* The XSS Payload will execute
**Evidence of Exploitation:**
{width=794 height=324}
I would also like to request a CVE for this issue. Could you let me know whether Tryton is a CNA that can issue CVEs for this project, or if I should use the MITRE/CVE Services.
issue