Summary
Snipe-IT contains a stored cross-site scripting vulnerability in the uploaded-files API when XML or XSLT attachments are served inline without the web controller's safe-content restrictions. An authenticated attacker with file-management access may create a malicious attachment that executes JavaScript in the Snipe-IT origin when opened by an authorized victim.
Affected context
The issue occurs in Snipe-IT deployments where:
- Authenticated users can upload XML or XSLT attachments
- Uploaded files can be retrieved through the API with inline rendering enabled
- The API controller does not enforce the same safe-inline content allowlist as the equivalent web controller
- An authorized user is persuaded or required to open the attachment URL
Risk depends on the attacker's file-management permissions and the victim's access to the affected object.
Exploit preconditions
- Attack surface: Authenticated uploaded-file API and browser-based inline rendering
- Required access: An authenticated account with permission to manage or upload files
- Trigger point: A victim opens an attacker-controlled XML or XSLT attachment through the inline file endpoint
- Why exploitation is possible: The response permits browser processing of an XML stylesheet reference, allowing stylesheet-generated JavaScript to execute in the Snipe-IT origin
- Victim condition: The victim must be authorized to view the associated object and access the attachment
Why this happens
The vulnerability results from inconsistent content-handling policy between equivalent file-serving controllers. The API path permits attacker-controlled XML and XSLT content to be rendered inline without applying a restrictive allowlist, allowing the browser to interpret an XML stylesheet reference and execute script in the application's origin. This maps to CWE-79: Improper Neutralization of Input During Web Page Generation, because attacker-controlled content is delivered in a context where it can generate executable browser script.
Potential impact
- An attacker may execute JavaScript in the Snipe-IT origin
- A malicious attachment could read same-origin data available to the victim
- The script could perform authenticated actions using the victim's privileges
- Sensitive asset, license, or user information could be exposed
- Administrative or other privileged workflows could be abused if a higher-privileged victim opens the attachment
General mitigation guidance
Mitigation generally focuses on treating uploaded files as untrusted content and applying one consistent serving policy across all controllers.
Common defensive patterns include:
- Disallowing inline rendering of XML, XSLT, and other active or browser-interpreted formats unless there is a strong business requirement
- Serving untrusted files as downloads with attachment-oriented content-disposition behavior
- Applying a strict allowlist for file types, response headers, and rendering modes at every file-serving endpoint
- Storing user-uploaded content on an isolated origin where possible
- Validating file content rather than relying only on filename extensions or MIME types
- Enforcing strong content security policies and minimizing privileges available to authenticated sessions
- Preserving authorization checks for both the parent object and the requested attachment
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying inline responses for XML, XSLT, SVG, HTML, or other active content
- Code review comparisons between API and web file-serving controllers
- Tests that upload potentially active formats and verify restrictive response headers and download behavior
- Dynamic testing for stylesheet references, script execution, and same-origin access through uploaded files
- Monitoring for unusual file uploads followed by attachment access by privileged users
- Policy enforcement that requires centralized, approved file-serving components instead of endpoint-specific handling
Automated security review tools may help identify inconsistent sanitization and unsafe content-disposition decisions.
