GHSA-r324-29wm-vcjm: 
PHP 취약점 분석 및 완화

Summary

Any signed-in user could upload an HTML or SVG file that ran as a web page on the forum's own domain. Anyone who opened a link to it could have their account taken over, including moderators and administrators. Fixed in v0.7.3.

Details

Waterhole ships config/uploads.php with 'allowed_mimetypes' => [], which UploadController passes to File::types(), so attachments of any type are accepted. Upload::fromFile() stored each file on the public uploads disk as uploads/<hash>.<extension>, where the extension comes from the file's detected content (UploadedFile::hashName()). HTML content was stored as .html, SVG as .svg and XML as .xml, and the web server served them from the forum's origin with an active content type. Because the file runs on the same origin, a script in it can read the XSRF-TOKEN cookie and send authenticated requests as the victim, such as changing their password. Login counts as a recent password confirmation, so no re-confirmation prompt blocks this. The fix (v0.7.3) stores uploads detected as HTML, XML (including SVG), JavaScript or PHP as .txt with type text/plain, so they are served as inert text. The files can still be attached and downloaded.

Proof of concept

1. On a Waterhole forum with default settings, sign in as any user who can post.
2. Create a file named test.html containing: <script>alert(document.domain)</script>
3. Attach it to a post using the composer's upload button. The upload succeeds and the post links to /storage/uploads/<hash>.html.
4. As another signed-in user, open that link. The script runs on the forum's domain. The same works with an SVG containing a <script> element.

Impact

Stored cross-site scripting (CWE-79). It affects every Waterhole forum running a version below 0.7.3 that allows uploads (the default) and serves uploads from the forum's own domain (the default public disk). Any signed-in user can take over the account of any user who opens a link to the uploaded file, including moderators and administrators. Files uploaded before upgrading are not changed by the update. After upgrading, delete any .html, .htm, .svg, .xhtml, .xml or .js files in the uploads directory (storage/app/public/uploads by default). Workaround if you can't upgrade straight away: set allowed_mimetypes in config/waterhole/uploads.php to safe types, for example: 'allowed_mimetypes' => ['jpg', 'jpeg', 'png', 'gif', 'webp', 'pdf', 'txt', 'zip'], Then delete the existing files listed above.