I am currently doing a bug bounty program and found a possible file upload vulnerability, but I am not so sure about it.
The vulnerability is on the chat function. In the chat function, users are allowed to communicate with each other and attach files.
Upon sending the message, I turned on my burpsuite and intercept the request. It turns out that the body of the POST request to the server includes the URL image where the image was uploaded. The image is uploaded to a subdomain of the company and when it is changed to my own domain, I was able to upload my own file from my domain, but is only limited to images. I tried uploading .SVG files with XSS payloads but they are not executed inside of the chat. I found out the image being displayed inside of the chat is being put inside of an
So it would look something like this;
<img class='...' src='https://myowndomain.com/StoredXss.svg>
If we click on the image, it will only be enlarged but the xss payload isn't executed and of course, if we 'open new tab' this image, the xss will be executed.
Things I tried:
- change the extension into a php file (doesn't execute since it is wrapped inside of a img tag)
- change the url with xss payload (dangerous chars are converted to html entities)
Is there a possibility to exploit this in the chat?