Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution, Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-434 and CWE-79.
Summary
Kiwi TCMS, an open source test management system allows users to upload attachments to test plans, test cases, etc. Versions of Kiwi TCMS prior to 12.5 had introduced changes which were meant to serve all uploaded files as plain text in order to prevent browsers from executing potentially dangerous files when such files are accessed directly. The previous Nginx configuration was incorrect allowing certain browsers like Firefox to ignore the `Content-Type: text/plain` header on some occasions thus allowing potentially dangerous scripts to be executed. Additionally, file upload validators and parts of the HTML rendering code had been found to require additional sanitation and improvements. Version 12.5 fixes this vulnerability with updated Nginx content type configuration, improved file upload validation code to prevent more potentially dangerous uploads, and Sanitization of test plan names used in the `tree_view_html()` function.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| kiwitcms | Kiwi | before 12.5 | 12.5 | Patch available | CNA |
| — | kiwitcms (PyPI) | before 12.5 | 12.5 | Patch available | GHSA-jpgw-2r9m-8qfw |
- Kiwi Vendorkiwitcms Affected before 12.5 Fixed in 12.5 Patch available CNA
- kiwitcms (PyPI) Vendor— Affected before 12.5 Fixed in 12.5 Patch available GHSA-jpgw-2r9m-8qfw
Remediation
- Fix · CNA Kiwi (kiwitcms) Fixed in 12.5
- Fix · GHSA-jpgw-2r9m-8qfw kiwitcms (PyPI) Fixed in 12.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-36809
- 2026-10-03 Alias added: GHSA-jpgw-2r9m-8qfw
References
Exploit 2
Patch 2
Advisory 2
Other 7
- https://kiwitcms.org/blog/kiwi-tcms-team/2023/07/04/kiwi-tcms-125/
- https://github.com/kiwitcms/kiwi/commit/195ea53eaaf360c19227c864cc0fe58910032c3c
- https://github.com/kiwitcms/kiwi/commit/ffb00450be52fe11a82a2507632c2328cae4ec9d
- https://github.com/kiwitcms/Kiwi
- https://huntr.dev/bounties/511489dd-ba38-4806-9029-b28ab2830aa8
- https://huntr.dev/bounties/c6eeb346-fa99-4d41-bc40-b68f8d689223
- https://kiwitcms.org/blog/kiwi-tcms-team/2023/07/04/kiwi-tcms-125
More kiwitcms Kiwi Tcms vulnerabilities
- TI-2023-14429 Kiwi TCMS unrestricted file upload vulnerability CVSS 3.1CRITICAL 9.0
- TI-2023-14444 Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow CVSS 3.1HIGH 8.8
- TI-2023-16845 Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS CVSS 3.1HIGH 8.1
- TI-2022-03753 Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi CVSS 3.1MEDIUM 5.4
- TI-2023-14379 Kiwi TCMS may allow user to update email address to unverified one CVSS 3.1MEDIUM 4.3
- TI-2023-10618 Kiwi TCMS has no protection against brute-force attacks on login page CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-36809 · CVE Program
- CVE-2023-36809 · NVD
- FIRST EPSS
- GHSA-jpgw-2r9m-8qfw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences