Description

A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. ImageIO.read() is a format-agnostic read - it returns non-null for a polyglot PNG|<img onerror> payload, which is exactly why the "image-only" guard is bypassable; the attacker-controlled suffix + /upload/** static mapping is what turns the upload into persisted XSS rather than a one-shot. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-20T19:17:13.133Z",
  "pubdate": "2026-09-20T19:17:13.133Z",
  "executiveSummary": "A stored Cross-Site Scripting (XSS) vulnerability exists in the newbee-ltd newbee-mall platform, affecting versions up to 1.0.0. The flaw resides within the Goods Save Endpoint, specifically handled by controller/common/UploadController.java.\nThe vulnerability allows an unauthenticated or remote attacker to inject malicious scripts into the application by manipulating the goodsName argument during the upload process. The impact is significant, as successful exploitation results in the execution of arbitrary JavaScript in the context of the victim's session, potentially leading to session hijacking, unauthorized data access, or defacement.\nThe vulnerability is critical due to the public availability of the exploit. It stems from insufficient validation of file content and improper handling of user-supplied input that is subsequently rendered in a web browser. Because the application utilizes a static mapping that persists uploaded files, the injected payload becomes a permanent fixture of the application's environment. Immediate action is required to sanitize inputs and restrict the execution of untrusted file uploads to prevent unauthorized script execution.",
  "technicalDetails": "The vulnerability is located in the Goods Save Endpoint, managed by controller/common/UploadController.java in newbee-mall versions up to 1.0.0. The primary root cause is an inadequate validation mechanism combined with the misuse of the ImageIO.read() function. The application attempts to enforce an 'image-only' security guard to filter uploaded files; however, this implementation is fundamentally flawed due to the nature of polyglot file parsing in Java.\nImageIO.read() is a format-agnostic operation that evaluates the provided byte stream to identify image signatures. An attacker can craft a malicious polyglot file, such as a PNG structure containing an <img onerror> HTML/JavaScript payload. Because ImageIO.read() returns a non-null value for such polyglots, the 'image-only' verification check is successfully bypassed. The malicious payload is subsequently treated as a valid image file and persisted on the server.\nThe exploitation flow proceeds as follows: 1) The attacker interacts with the Goods Save Endpoint and submits a multipart form request containing the malicious polyglot file and the manipulated goodsName argument. 2) The server-side controller fails to sanitize the input properly, allowing the malicious script to be saved within the application's static resource directory. 3) The combination of the attacker-controlled suffix and the /upload/** static mapping ensures that the uploaded file is publicly accessible and treated as a web resource. 4) When a user or administrator navigates to the associated resource, the browser parses the polyglot file, triggering the onerror event handler in the injected payload. This executes arbitrary JavaScript in the victim's browser session.\nThis vulnerability is classified as Stored XSS because the malicious content is permanently stored on the target server. The attack can be initiated remotely without requiring advanced authentication, depending on the implementation of the upload endpoint. The post-exploitation impact includes the potential for session theft, bypass of CSRF protections, unauthorized interaction with the application interface as the victim, and the delivery of further malicious payloads. The lack of strict content-type enforcement and the reliance on insecure image parsing libraries create a persistent threat vector that bypasses conventional file upload filters."
}