Description
EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT /api/v1/restores/json/resources/:id, which accepts a resource kind of image paired with a text/html MIME type without checking consistency. Authenticated members can share the note and send the public blob link to a victim, whose browser executes the script to mint a non-expiring API token granting read and write access to the victim's notes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tianma-if | EdgeEver | 1.9.0 <2.13.0 | — |
References
- https://vul.yulun.ac.cn/20261028/edgeever/
- https://github.com/tianma-if/edgeever/issues/701
- https://github.com/tianma-if/edgeever/commit/dc5a55a1c26d6add0e28d95dc0b282c611692e34
- https://github.com/tianma-if/edgeever/blob/eeaab088f41d0417fbce2266f58ff4adde7f5d76/apps/api/src/backup-routes.ts#L487-L550
- https://github.com/tianma-if/edgeever/blob/eeaab088f41d0417fbce2266f58ff4adde7f5d76/apps/api/src/share-routes.ts#L77-L80
- https://www.vulncheck.com/advisories/edgeever-1.9.0-before-2.13.0-stored-xss-via-backup-restore-and-public-shares