Backdrop Cms v1.25.1 - Stored Cross-Site Scripting (XSS)

Backdrop CMS v1.25.1: Stored Cross-Site Scripting (XSS) Vulnerability Explained

Backdrop CMS, a lightweight fork of Drupal designed for simplicity and ease of use, has recently been flagged for a critical security flaw in version v1.25.1. This vulnerability, identified as a stored Cross-Site Scripting (XSS), allows attackers to inject malicious JavaScript code into the system through a seemingly innocuous file upload process. The exploit is particularly dangerous because the payload is persistently stored and executed whenever the affected resource is rendered.

Understanding Stored XSS

Stored XSS occurs when malicious scripts are permanently saved on a server and later executed in the context of a user’s browser. Unlike reflected XSS, which requires a user to click a malicious link, stored XSS can trigger automatically—making it far more dangerous in real-world scenarios.

For example, if a website allows users to upload a logo image and fails to sanitize the file content, an attacker could embed a script within an SVG file. When the logo is displayed, the browser executes the script, potentially stealing cookies, redirecting users, or compromising session integrity.

Exploit Details: SVG File Upload Abuse

The vulnerability in Backdrop CMS v1.25.1 stems from improper handling of SVG (Scalable Vector Graphics) file uploads within the Site Information configuration page. Specifically, the admin/config/system/site-information endpoint accepts file uploads without validating or sanitizing the content.

Attackers can exploit this by uploading a malicious SVG file containing embedded JavaScript. The following example demonstrates the payload:

 
 
      alert(document.location);
   

Explanation: This SVG file includes a harmless visual element—a green triangle—but also contains a <script> tag that executes alert(document.location) when rendered. This script runs in the browser context, revealing the current URL to the attacker.

While the alert is harmless in this proof-of-concept (POC), in real attacks, the script could:

• Steal session cookies via document.cookie
• Redirect users to phishing sites
• Inject malicious content into the DOM
• Perform cross-origin requests to internal APIs

Attack Vector: Administrative Interface

The exploit requires authentication, meaning only users with administrative privileges can upload files to the site_logo_upload field. This limits the attack surface but still poses significant risk:

• Compromised admin accounts
• Insider threats
• Weak password policies
• Phishing or credential theft

Once an attacker gains access to the admin panel, they can upload the malicious SVG and trigger execution simply by visiting the site logo URL, such as:

http://localhost/backdrop/files/malas_2.svg

Any user visiting this URL—especially administrators or content editors—will have the script executed in their browser.

Technical Analysis of the Request

The HTTP request used in the exploit demonstrates how the malicious SVG file is transmitted:

Field	Value
Content-Disposition	form-data; name="files[site_logo_upload]"; filename="malas.svg"
Content-Type	image/svg+xml
Content	Malicious SVG code

Despite the Content-Type being image/svg+xml, the server does not perform content validation or sanitize the file before storing it. This failure allows the script to be preserved and rendered as HTML.

Root Cause: Lack of Input Sanitization

Backdrop CMS, while designed for simplicity, lacks robust security checks when handling file uploads. The core issue is that:

• SVG files are treated as images, not as potentially executable content
• Script tags within SVG are not filtered or removed
• No validation or sandboxing of file contents occurs during upload

Although SVG files are inherently designed for vector graphics, they support scripting via <script> elements. This capability is often overlooked in security assessments, leading to vulnerabilities like this one.

Security Recommendations

For developers and administrators, the following mitigation strategies are essential:

• Validate file types and content: Implement MIME type checks and scan file contents for scripting elements.
• Sanitize SVG files: Strip <script> tags and prevent execution of embedded code.
• Use sandboxed rendering: Serve SVG files through a content security policy (CSP) that disables script execution.
• Limit upload permissions: Restrict file uploads to non-admin users and enforce role-based access control.
• Update to patched versions: Immediately upgrade from v1.25.1 to the latest secure release.

Conclusion: A Wake-Up Call for CMS Security

Backdrop CMS v1.25.1’s stored XSS vulnerability underscores a critical truth: even simple, lightweight systems are not immune to serious security flaws. The attack demonstrates how a small oversight—failing to sanitize SVG file content—can lead to widespread exploitation.

Security is not about complexity; it’s about diligence. Every file upload, every form input, every rendered resource must be treated as a potential attack vector. Developers must assume that any user input can be malicious and apply defense-in-depth principles.

For organizations using Backdrop CMS, this vulnerability is a red flag. Immediate patching, thorough auditing, and ongoing security training are essential to prevent exploitation.