Listen to this Post
ThingsBoard versions before v4.2.1 contain a stored XSS vulnerability in the Image Gallery. Authenticated users can upload malicious SVG images containing JavaScript code. The ImageController fails to sanitize or restrict script execution when these images are loaded. Upon access to the public API endpoint for the SVG, or when embedded in an iframe during widget creation, the JavaScript executes in the user’s browser. This occurs because SVG files can include scripts, and the application lacks proper validation. The exploit triggers when any user views a dashboard or page containing the malicious widget. The script runs within the victim’s session context, allowing session hijacking. Attackers can perform unauthorized actions, compromise accounts, and steal data. The vulnerability requires authenticated access to upload, but affects all viewers. It is rated medium due to the need for user interaction and authenticated attacker. The issue is fixed in version v4.2.1.
Platform: ThingsBoard
Version: Before v4.2.1
Vulnerability: Stored XSS
Severity: Medium
date: 2025-11-27
Prediction: Patch v4.2.1
What Undercode Say:
Analytics:
Showing bash commands and codes related to the blog
curl -X POST -H "Authorization: Bearer <token>" -F "[email protected]" http://thingsboard-host/api/images
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.cookie)"> </svg>
how Exploit:
Authenticated user uploads malicious SVG. Embed SVG in widget iframe. Deploy widget to dashboard. Victim views dashboard, executing script.
Protection from this CVE:
Upgrade to v4.2.1. Sanitize SVG uploads. Implement Content-Security-Policy.
Impact:
Session hijacking. Unauthorized actions. Account compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
