Listen to this Post
Snipe-IT’s uploaded-files API accepts XML documents and later serves them inline without applying the safe-inline allowlist used by the equivalent web controller. An authenticated user who can attach files to a supported object can upload an XSLT stylesheet and an XML document that references it through xml-stylesheet. When another authorized user opens the XML file through the API with ?inline=true, the browser applies the attacker-controlled stylesheet, which produces HTML containing JavaScript in the Snipe-IT origin. This was reproduced against commit df8e3b144331d0c1cc14778f900e7646d1d9a509 (v8.6.3-231-gdf8e3b1443). The attack requires an authenticated account with file access to at least one supported object and one victim interaction. Scope changes because attacker-controlled code executes in another user’s Snipe-IT security context. The script can read same-origin data available to the victim and perform authenticated actions as that victim. The vulnerability exists in app/Http/Controllers/Api/UploadedFilesController.php, where the show() method honors the attacker-controlled inline=true query parameter for every uploaded file type and calls Storage::download(…, [‘Content-Disposition’ => ‘inline’]) without calling StorageHelper::allowSafeInline(). The non-API UploadedFilesController::show() already calls StorageHelper::allowSafeInline() before returning an inline response, but the missing equivalent check in the API controller creates the vulnerable behavior. Laravel derives the response Content-Type from each stored file, returning text/xml; charset=utf-8, while the controller overrides the normal attachment disposition with Content-Disposition: inline. Chromium processes the xml-stylesheet instruction, loads the second same-origin API attachment as XSLT, and executes script in the HTML document produced by the transform. The default CSP includes script-src ‘self’ ‘unsafe-inline’ ‘unsafe-eval’, so it does not mitigate the injected inline script. This issue is fixed in version 8.7.0.
DailyCVE Form:
Platform: Snipe-IT
Version: <8.7.0
Vulnerability: Stored XSS
Severity: High
date: 2026-09-24
Prediction: 2026-08-11
What Undercode Say:
Analytics:
curl -i \ -H 'Authorization: Bearer ATTACKER_API_TOKEN' \ -H 'Accept: application/json' \ -F 'file[][email protected];type=text/xml' \ 'https://snipe-it.example/api/v1/models/1/files' curl -s \ -H 'Authorization: Bearer ATTACKER_API_TOKEN' \ -H 'Accept: application/json' \ 'https://snipe-it.example/api/v1/models/1/files' curl -i \ -H 'Authorization: Bearer ATTACKER_API_TOKEN' \ -H 'Accept: application/json' \ -F 'file[][email protected];type=text/xml' \ 'https://snipe-it.example/api/v1/models/1/files'
Exploit: (Educational Purposes!)
The exploit involves uploading a malicious XSLT stylesheet and an XML document that references it. When a victim opens the XML file through the API with ?inline=true, the browser applies the attacker-controlled stylesheet, executing JavaScript in the Snipe-IT origin.
Protection: from this CVE
- Upgrade to Snipe-IT version 8.7.0 or later.
- Apply the fix in grokability/snipe-it@e929b31.
- Ensure Content Security Policy (CSP) headers are properly configured to restrict script execution.
- Avoid opening untrusted XML attachments through the API with the inline parameter.
Impact:
An attacker can execute arbitrary JavaScript in the Snipe-IT origin when a victim opens the malicious attachment URL. Depending on the victim’s privileges, this can enable reading same-origin pages and API responses, performing state-changing actions with the victim’s session and privileges, exposing sensitive asset, user, license, and configuration information, and administrative account compromise when a superuser opens the attachment. Cookies marked HttpOnly cannot be read directly, but this does not prevent same-origin authenticated requests or reading their responses.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
