Listen to this Post
The vulnerability in ThingsBoard versions prior to v4.2.1 involves a stored cross-site scripting (XSS) attack via malicious SVG image uploads. Authenticated users can upload SVG files containing embedded JavaScript code through the “Image Gallery” feature. The ImageController fails to properly sanitize or restrict the execution of scripts within SVG images when served via public API endpoints. When a victim accesses the malicious image directly through the endpoint or views it embedded in an iframe within a widget on dashboards, the browser renders the SVG and executes the contained JavaScript. This occurs because SVG is an XML-based format that can include
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent may adversely affect certain features and functions.
We do not sell your personal data. If you wish to exercise your rights under applicable privacy laws, please visit our Do Not Sell My Personal Information page.