# Exploit Title: Stored Cross-Site Scripting (XSS) in ARIS: Business
Process Management
# Edition Version 10.0.21.0
# Exploit Author: Seid Yassin
# Date: 2024-03-28
# Vendor: Software AG
# Software Link: https://aris.com/
# Version: ARIS: Business Process Management

## Description:

Discovered a file upload feature lacking proper file extension validation.
This vulnerability allows attackers to upload any type of file, including
malicious ones. To demonstrate this, we successfully uploaded an SVG file
to carry out a Cross-Site Scripting (XSS) attack. In XSS attacks, malicious
scripts are injected into web pages viewed by other users, potentially
leading to data theft or unauthorized actions leading to potential theft of
cookies and session tokens.

## Background:

Cross-site scripting (XSS) is a common web security vulnerability that
compromises user interactions with a vulnerable application. Stored XSS
occurs when user input is stored in the application and executed whenever a
user triggers or visits the page.

## Issue:

A stored cross-site scripting (XSS) vulnerability in ARIS: Business Process
Management  software enables a malicious authenticated user to store a xss
payload(via SVG) using the web interface. Then, when viewed by a properly
authenticated user or administrator, the JavaScript payload executes within
SVG and disguises all associated actions as performed by that unsuspecting
authenticated user/administrator.

## Steps To Reproduce:

1. Log into the ARIS application.
2. Navigate to my tasks and select any of the task and upload documents
(change request form)
3. Insert any svg file with xss script in it . eg.
https://gist.github.com/rudSarkar/76f1ce7a65c356a5cd71d058ab76a344

## Expected Result:

After a user uploads a new document in the Change Request Form, they can
utilize the link for the SVG file and UUID to access another path at
{{url}}/documents/api/documents/{{UUID}}/content

## Actual Result:

The ARIS application is vulnerable to Stored Cross-Site Scripting, as
evidenced by the successful execution of the injected payload.

## Proof of Concept:

Attached Screenshots for the reference.