CVE-2023-4382

Executive Summary

CVE-2023-4382 is a Stored Cross-Site Scripting (XSS) vulnerability in the tdevs Hyip Rio 2.1 application, specifically within the Profile Settings avatar upload functionality. An authenticated attacker can upload a malicious SVG file containing JavaScript, which is then stored on the server and executed in the browser of any user viewing the attacker's profile. The vendor was contacted but did not respond, leaving the vulnerability unpatched. The public exploit code demonstrates a trivial attack vector, making this a high-priority finding for any organization using this software.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker must be an authenticated user.
• User Interaction (UI): Required (R) – Victim must view the attacker's profile.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Low (CVSS 3.5) but with a high likelihood of exploitation due to public PoC and lack of patch.

Deep Dive & Mechanics

The vulnerability resides in the /user/settings endpoint of Hyip Rio 2.1. The application fails to properly validate the file type and content of uploaded avatar images. The upload handler only checks the MIME type in the HTTP request (e.g., image/png) but does not verify the actual file extension or content. An attacker can intercept the upload request using a proxy like Burp Suite, change the filename to XSS.svg, and inject malicious JavaScript within the SVG XML structure.

The SVG file is then stored on the server under /assets/global/images/ with a randomized filename. When any user (including administrators) visits the attacker's profile, the browser renders the SVG, executing the embedded JavaScript. This allows the attacker to steal session cookies, perform actions on behalf of the victim, or deface the profile page.

Vulnerable vs. Patched Code

Vulnerable Code (Hyip Rio 2.1): The upload handler likely performs a simple MIME type check without validating the file extension or content. Example pseudocode:

// Vulnerable: Only checks MIME type from the request
if ($_FILES['avatar']['type'] == 'image/png' || $_FILES['avatar']['type'] == 'image/jpeg') {
    move_uploaded_file($_FILES['avatar']['tmp_name'], $uploadPath);
}

Patched Code (Hypothetical): A secure implementation would validate the file extension, content type, and optionally sanitize SVG files:

// Patched: Validate file extension and content
$allowedExtensions = ['jpg', 'jpeg', 'png', 'gif'];
$extension = strtolower(pathinfo($_FILES['avatar']['name'], PATHINFO_EXTENSION));
if (!in_array($extension, $allowedExtensions)) {
    die('Invalid file type');
}
// Additionally, for SVG files, strip script tags
if ($extension === 'svg') {
    $svgContent = file_get_contents($_FILES['avatar']['tmp_name']);
    $svgContent = preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $svgContent);
    file_put_contents($_FILES['avatar']['tmp_name'], $svgContent);
}
move_uploaded_file($_FILES['avatar']['tmp_name'], $uploadPath);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid user account on the Hyip Rio 2.1 instance.
• Burp Suite or similar proxy tool.
• A malicious SVG file (e.g., XSS.svg).

Steps:

1. Log in as a normal user.
2. Navigate to https://target/user/settings.
3. Upload any image file (e.g., test.png) as the avatar.
4. Intercept the POST request to /user/settings/profile-update using Burp Suite.
5. Modify the filename parameter to XSS.svg and replace the file content with the malicious SVG payload.
6. Forward the request.
7. Retrieve the uploaded file path by inspecting the avatar URL or using Burp Logger.
8. Access the malicious SVG at https://target/assets/global/images/<random>.svg.

Exploit Code (from Exploit-DB):

# Exploit Title: Hyip Rio 2.1 - Arbitrary File Upload
# Exploit Author: CraCkEr
# Date: 30/07/2023
# Vendor: tdevs
# Vendor Homepage: https://tdevs.co/
# Software Link: https://hyiprio-feature.tdevs.co/
# Version: 2.1
# Tested on: Windows 10 Pro
# Impact: Allows User to upload files to the web server
# CVE: CVE-2023-4382

## Description

Allows Attacker to upload malicious files onto the server, such as Stored XSS

## Steps to Reproduce:

1. Login as a [Normal User]
2. In [User Dashboard], go to [Profile Settings] on this Path: https://website/user/settings
3. Upload any Image into the [avatar]
4. Capture the POST Request with [Burp Proxy Intercept]
5. Edit the file extension to .svg & inject your [Evil-Code] or [Stored XSS]

-----------------------------------------------------------
POST /user/settings/profile-update HTTP/2

Content-Disposition: form-data; name="avatar"; filename="XSS.svg"
Content-Type: image/png

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">
alert("XSS by Skalvin");
</script>
</svg>
-----------------------------------------------------------

6. Send the Request
7. Capture the GET request from [Burp Logger] to get the Path of your Uploaded [Stored-XSS] or right-click on the Avatar and Copy the Link
8. Access your Uploded Evil file on this Path: https://website/assets/global/images/********************.svg

[-] Done

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to /user/settings/profile-update with Content-Type: image/png but a filename ending in .svg.
• Alert on file uploads where the MIME type does not match the file extension.
• Use WAF rules to block SVG files containing <script> tags.

Response:

• Immediately isolate the affected server.
• Review access logs for the uploaded SVG file path.
• Remove all malicious SVG files from /assets/global/images/.
• Force password reset for all users who may have been affected.
• Apply a virtual patch by blocking SVG uploads at the web server level.

Indicators of Compromise (IOCs)

• File Path: /assets/global/images/*.svg (randomized filename)
• Network Request: POST to /user/settings/profile-update with filename="*.svg"
• Log Entry: POST /user/settings/profile-update HTTP/2 with Content-Disposition: form-data; name="avatar"; filename="*.svg"
• Malicious Payload: SVG files containing <script> tags or event handlers like onload.
• User Agent: Any standard browser (e.g., Chrome, Firefox) – no specific UA required.

Detection Engineering

YARA Rule

rule CVE_2023_4382_SVG_XSS {
    meta:
        description = "Detects malicious SVG files used in CVE-2023-4382"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-4382"
    strings:
        $svg_header = "<?xml" ascii wide nocase
        $svg_tag = "<svg" ascii wide nocase
        $script_tag = "<script" ascii wide nocase
        $event_handler = /on\w+\s*=/ ascii wide nocase
    condition:
        $svg_header and $svg_tag and ($script_tag or $event_handler)
}

Sigma Rule

title: CVE-2023-4382 - Stored XSS via SVG Upload in Hyip Rio 2.1
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to /user/settings/profile-update with SVG file upload
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/user/settings/profile-update'
        cs-uri-query|contains: 'avatar'
        sc-status: 200
    filter:
        cs-uri-query|endswith: '.svg'
    condition: selection and filter
falsepositives:
    - Legitimate SVG uploads (if allowed by admin)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-4382 - Stored XSS via SVG Upload"; flow:to_server,established; content:"POST"; http_method; content:"/user/settings/profile-update"; http_uri; content:"avatar"; http_client_body; content:"filename=\""; distance:0; content:".svg\""; distance:0; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads at the web server level (e.g., via .htaccess or Nginx config).
2. Implement file extension whitelisting (only allow jpg, jpeg, png, gif).
3. Use a WAF to block requests containing SVG files with embedded scripts.
4. Remove all existing SVG files from the upload directory.

Long-Term Fix:

• Since the vendor is unresponsive, consider migrating to a different platform or hiring a developer to patch the code.
• Implement server-side validation of file content using libraries like getimagesize() for images.
• For SVG files, use a sanitizer library (e.g., DOMPurify on the server side) to strip malicious content.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Monitor for anomalous file uploads and alert on any SVG files.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: C2FEB27573F3C55DA56A34D6] */}