ARIS: Business Process Management 10.0.21.0 Cross Site Scripting

# Exploit Title: Stored Cross-Site Scripting (XSS) in ARIS: BusinessProcess Management# Edition Version 10.0.21.0# Exploit Author: Seid Yassin# Date: 2024-03-28# Vendor: Software AG# Software Link: https://aris.com/# Version: ARIS: Business Process Management## Description:Discovered a file upload feature lacking proper file extension validation.This vulnerability allows attackers to upload any type of file, includingmalicious ones. To demonstrate this, we successfully uploaded an SVG fileto carry out a Cross-Site Scripting (XSS) attack. In XSS attacks, maliciousscripts are injected into web pages viewed by other users, potentiallyleading to data theft or unauthorized actions leading to potential theft ofcookies and session tokens.## Background:Cross-site scripting (XSS) is a common web security vulnerability thatcompromises user interactions with a vulnerable application. Stored XSSoccurs when user input is stored in the application and executed whenever auser triggers or visits the page.## Issue:A stored cross-site scripting (XSS) vulnerability in ARIS: Business ProcessManagement  software enables a malicious authenticated user to store a xsspayload(via SVG) using the web interface. Then, when viewed by a properlyauthenticated user or administrator, the JavaScript payload executes withinSVG and disguises all associated actions as performed by that unsuspectingauthenticated user/administrator.## Steps To Reproduce:1. Log into the ARIS application.2. Navigate to my tasks and select any of the task and upload documents(change request form)3. Insert any svg file with xss script in it . eg.https://gist.github.com/rudSarkar/76f1ce7a65c356a5cd71d058ab76a344## Expected Result:After a user uploads a new document in the Change Request Form, they canutilize the link for the SVG file and UUID to access another path at{{url}}/documents/api/documents/{{UUID}}/content## Actual Result:The ARIS application is vulnerable to Stored Cross-Site Scripting, asevidenced by the successful execution of the injected payload.## Proof of Concept:Attached Screenshots for the reference.