Critical: Web server has stored XSS and unauthenticated file upload #26

New issue

Closed

opened 2026-06-10 15:16:01 +00:00 by Mark · 0 comments

Mark commented

2026-06-10 15:16:01 +00:00

Owner

Findings

C2: All activity renderers (render_coloring, render_maze, render_wordsearch, render_matching, render_jigsaw, render_colorbynumber, render_story) inject user-controlled narration text into HTML/JavaScript f-strings with only weak backtick escaping `. No HTML escaping. Attacker injects via stories.json mutation.
C3: /api/save endpoint:
- Reads Content-Length without validation — OOM via Content-Length: 999999999
- No authentication or CSRF token
- No rate limiting — disk exhaustion via arbitrary base64 writes
- No file type validation beyond .png extension

Affected files

web/server.py (lines ~100-104, 507, 581-588)

Impact

Stored XSS in children's book app. Unauthenticated remote DoS and disk exhaustion.

## Findings - **C2**: All activity renderers (render_coloring, render_maze, render_wordsearch, render_matching, render_jigsaw, render_colorbynumber, render_story) inject user-controlled narration text into HTML/JavaScript f-strings with only weak backtick escaping `. No HTML escaping. Attacker injects via stories.json mutation. - **C3**: `/api/save` endpoint: - Reads `Content-Length` without validation — OOM via `Content-Length: 999999999` - No authentication or CSRF token - No rate limiting — disk exhaustion via arbitrary base64 writes - No file type validation beyond `.png` extension ## Affected files - `web/server.py` (lines ~100-104, 507, 581-588) ## Impact Stored XSS in children's book app. Unauthenticated remote DoS and disk exhaustion.