Summary
Countly's star-rating plugin stores attacker-controlled feedback files while trusting the submitted MIME type and later serves them from a public preview path. A non-global application administrator may exploit this to deliver active content that executes when a global administrator opens the preview, potentially exposing authenticated session capabilities.
Countly's star-rating plugin stores attacker-controlled feedback files while trusting the submitted MIME type and later serves them from a public preview path. A non-global application administrator may exploit this to deliver active content that executes when a global administrator opens the preview, potentially exposing authenticated session capabilities.
Affected context
The issue occurs in Countly deployments using the star-rating plugin when feedback files can be uploaded by a non-global application administrator and later previewed by a global administrator. Risk increases when uploaded content is publicly reachable and the response Content-Type is derived from attacker-controlled metadata, allowing browsers to interpret the stored file as executable content in the Countly origin.
The issue occurs in Countly deployments using the star-rating plugin when feedback files can be uploaded by a non-global application administrator and later previewed by a global administrator. Risk increases when uploaded content is publicly reachable and the response Content-Type is derived from attacker-controlled metadata, allowing browsers to interpret the stored file as executable content in the Countly origin.
Exploit preconditions
- Attack surface: The star-rating plugin's feedback file upload and preview functionality
- Required access: An authenticated non-global application administrator able to submit feedback files
- Trigger point: A global administrator opens the resulting feedback preview
- Why exploitation is possible: The application stores active content and reflects an attacker-influenced MIME type when serving it, allowing the browser to execute content within the trusted Countly origin
- Attack surface: The star-rating plugin's feedback file upload and preview functionality
- Required access: An authenticated non-global application administrator able to submit feedback files
- Trigger point: A global administrator opens the resulting feedback preview
- Why exploitation is possible: The application stores active content and reflects an attacker-influenced MIME type when serving it, allowing the browser to execute content within the trusted Countly origin
Why this happens
The vulnerability results from treating uploaded content as passive data while trusting client-influenced MIME metadata. The preview endpoint serves the stored content with a browser-interpretable Content-Type, creating a persistent script execution path when a privileged user views it. This is a stored cross-site scripting condition mapped to CWE-79, because attacker-controlled content is returned in a context where the browser can execute it as script.
The vulnerability results from treating uploaded content as passive data while trusting client-influenced MIME metadata. The preview endpoint serves the stored content with a browser-interpretable Content-Type, creating a persistent script execution path when a privileged user views it. This is a stored cross-site scripting condition mapped to CWE-79, because attacker-controlled content is returned in a context where the browser can execute it as script.
Potential impact
- A malicious user may execute script in a global administrator's Countly session
- Attackers could access authenticated session capabilities exposed to browser-side code
- Session-related values such as authentication or CSRF tokens could be disclosed
- The issue may enable unauthorized administrative actions or account compromise
- Sensitive application data could be accessed or altered through the victim's privileges
- A malicious user may execute script in a global administrator's Countly session
- Attackers could access authenticated session capabilities exposed to browser-side code
- Session-related values such as authentication or CSRF tokens could be disclosed
- The issue may enable unauthorized administrative actions or account compromise
- Sensitive application data could be accessed or altered through the victim's privileges
General mitigation guidance
Mitigation generally focuses on treating all uploaded files as untrusted and preventing browsers from interpreting them as active content.
Common defensive patterns include:
- Validate file type using trusted server-side inspection rather than supplied MIME metadata
- Restrict uploads to required formats and reject active or script-capable content
- Serve user-uploaded files from an isolated origin or non-executable download location
- Apply fixed, safe response headers such as restrictive Content-Type and Content-Disposition values
- Use context-appropriate output encoding and sanitization for preview features
- Enforce least privilege for application administrators and limit access to sensitive previews
- Apply strong Content Security Policy controls and avoid exposing session secrets to script-accessible contexts
Mitigation generally focuses on treating all uploaded files as untrusted and preventing browsers from interpreting them as active content.
Common defensive patterns include:
- Validate file type using trusted server-side inspection rather than supplied MIME metadata
- Restrict uploads to required formats and reject active or script-capable content
- Serve user-uploaded files from an isolated origin or non-executable download location
- Apply fixed, safe response headers such as restrictive Content-Type and Content-Disposition values
- Use context-appropriate output encoding and sanitization for preview features
- Enforce least privilege for application administrators and limit access to sensitive previews
- Apply strong Content Security Policy controls and avoid exposing session secrets to script-accessible contexts
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying upload handlers that copy client-supplied MIME types into response headers
- Code review checks for public file-serving endpoints under the primary application origin
- Tests that upload benign active-content markers and verify they are downloaded or blocked rather than rendered
- Dynamic scans for persistent content execution when privileged users open uploaded-file previews
- Policy enforcement requiring isolated origins, safe headers, and allowlisted file formats for user uploads
- Audit-log review for unusual feedback uploads followed by administrator preview access
Organizations can look for this class of issue through:
- Static analysis rules identifying upload handlers that copy client-supplied MIME types into response headers
- Code review checks for public file-serving endpoints under the primary application origin
- Tests that upload benign active-content markers and verify they are downloaded or blocked rather than rendered
- Dynamic scans for persistent content execution when privileged users open uploaded-file previews
- Policy enforcement requiring isolated origins, safe headers, and allowlisted file formats for user uploads
- Audit-log review for unusual feedback uploads followed by administrator preview access
