Stored cross-site scripting in CERT.LV’s Graphoscope via upload filenames

§ 01. Overview

Graphoscope is CERT.LV's open-source analysis platform. Analysts query many independent data sources – passive DNS, client databases, leaked-credential sets and others – from one web interface and see the results as a graph of related entities. Besides interactive search, users can upload a list of indicators for batch processing; the server queries every connected source and returns a processed report.

OffSeq found that the name of the uploaded file travelled from the upload request back into the page without being validated or encoded, so a crafted filename became stored script in the uploader's Graphoscope session.

§ 02. Root cause

The /upload handler took header.Filename – the filename= value of the multipart Content-Disposition header, entirely client-controlled – and stored it in MongoDB (users.uploads.in). The same string was then sent back to the uploader's own sessions over WebSocket in the uploaded, upload-processed and upload-lists messages, and the server also embedded it in notification text.

On the client, assets/js/notifications.js and assets/js/user-actions.js wrote those values into the page with innerHTML. Any markup in the filename was therefore parsed as HTML:

1curl -sk -b "$JAR" "https://127.0.0.1:8443/upload" \2  -F "source=demo" -F "format=json" -F "field=name" \3  -F "startTime=2024-01-01T00:00:00.000Z" \4  -F "endTime=2030-01-01T00:00:00.000Z" \5  -F "file=@/tmp/p.txt;filename=<img src=x onerror=alert(1)>.txt"

§ 03. Impact

The filename is reflected only to the account that uploaded it, so the attacker does not upload the file themselves – they get an analyst to. That is the platform's normal workflow: analysts upload indicator lists shared by partners and other teams. A list delivered with a crafted name runs script in the analyst's session as soon as they upload it, and again whenever their profile's upload list renders. The attacker needs no Graphoscope account; Linux and macOS accept <, > and quotes in filenames, so the name survives delivery.

On a platform built to aggregate an organisation's intelligence sources, script running in an analyst's session can read query results, indicator lists and anything else the interface shows that user, and act in the interface on their behalf. Session cookies are HttpOnly and SameSite=Strict, so the script cannot read the session cookie, and no other site can trigger the upload.

§ 04. The fix

OffSeq contributed a source-side fix in upload.go. The handler now applies filepath.Base() to the submitted name and accepts it only if it matches a strict allow-list:

1reSafeFilename = regexp.MustCompile(`^[A-Za-z0-9 ._-]{1,200}$`)

A non-matching name is rejected before anything is written to the upload queue or MongoDB, using the same response path as the handler's other errors. Ordinary names such as indicators.txt or IOCs - 2026-05.csv upload unchanged.

Because nothing dangerous reaches the stored value, no front-end change was needed to close the vector. The same check also blocks path components and NUL or control characters in names. Replacing the remaining innerHTML sinks with textContent was recommended as separate defence-in-depth work. CERT.LV merged the change as pull request #10.