# Exploit Title: Stored Cross-Site Scripting (XSS) in ARIS: Business Process Management # Edition Version 10.0.21.0 # Exploit Author: Seid Yassin # Date: 2024-03-28 # Vendor: Software AG # Software Link: https://aris.com/ # Version: ARIS: Business Process Management ## Description: Discovered a file upload feature lacking proper file extension validation. This vulnerability allows attackers to upload any type of file, including malicious ones. To demonstrate this, we successfully uploaded an SVG file to carry out a Cross-Site Scripting (XSS) attack. In XSS attacks, malicious scripts are injected into web pages viewed by other users, potentially leading to data theft or unauthorized actions leading to potential theft of cookies and session tokens. ## Background: Cross-site scripting (XSS) is a common web security vulnerability that compromises user interactions with a vulnerable application. Stored XSS occurs when user input is stored in the application and executed whenever a user triggers or visits the page. ## Issue: A stored cross-site scripting (XSS) vulnerability in ARIS: Business Process Management software enables a malicious authenticated user to store a xss payload(via SVG) using the web interface. Then, when viewed by a properly authenticated user or administrator, the JavaScript payload executes within SVG and disguises all associated actions as performed by that unsuspecting authenticated user/administrator. ## Steps To Reproduce: 1. Log into the ARIS application. 2. Navigate to my tasks and select any of the task and upload documents (change request form) 3. Insert any svg file with xss script in it . eg. https://gist.github.com/rudSarkar/76f1ce7a65c356a5cd71d058ab76a344 ## Expected Result: After a user uploads a new document in the Change Request Form, they can utilize the link for the SVG file and UUID to access another path at {{url}}/documents/api/documents/{{UUID}}/content ## Actual Result: The ARIS application is vulnerable to Stored Cross-Site Scripting, as evidenced by the successful execution of the injected payload. ## Proof of Concept: Attached Screenshots for the reference.