CVE-2024-4023: 
FlatPress vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability exists in flatpressblog/flatpress version 1.3. The vulnerability was discovered and reported through huntr.dev platform, and has been assigned CVE-2024-4023. The issue affects the file upload functionality when handling files with .xsig extension (NVD, CVE).

The vulnerability occurs when a user uploads a file with a .xsig extension and directly accesses this file. The server responds with a Content-type of application/octet-stream, which leads to the file being processed as an HTML file. This misconfiguration allows for potential execution of arbitrary JavaScript code. The vulnerability has been assigned a CVSS v3.0 base score of 8.1 (HIGH) with the vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H (NVD).

The vulnerability allows an attacker to execute arbitrary JavaScript code, which can be used to steal user cookies, perform HTTP requests, and access content of the same origin. This poses a significant security risk as it could lead to unauthorized access to sensitive information and potential account compromise (NVD).

A fix has been implemented that prevents the upload of files with .xsig extension. The patch can be found in the GitHub commit 3c9cc69364a45fd3f92d4bd606344b5dd1205d6a (GitHub Commit).