PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

Summary

Stored cross-site scripting (XSS) in PrivateBin's attachment download link. An anonymous attacker can create a paste with a text/html attachment that, with certain user interaction, bypasses protections similar to CVE-2022-24833. When a victim opens the "Download attachment" link in a new tab, the attacker's inline JavaScript executes in the PrivateBin instance's origin with full same-origin capability (cookie/localStorage access, same-origin fetch).

This is an incomplete fix of CVE-2022-24833. The original fix only applies to the inline preview blob (in case of SVG), never to the download link's blob. Thus a text/html (or image/svg) attachment completely bypasses sanitization, re-enabling the exact attack class on instances that don't enforce the recommended Content-Security-Policy, but with a slightly different attack process.

Instances using the default recommended CSP are protected (the blob inherits script-src 'self', blocking inline scripts). The vulnerability affects instances where CSP is weakened, stripped, or absent, which is exactly the defense-in-depth scenario the CVE-2022-24833 fix was meant to cover.

Requires fileupload = true (non-default) and a non-recommended CSP configuration.

Details

In js/privatebin.js, the function AttachmentViewer.setAttachment (line 2982) processes decrypted attachment data. Since PrivateBin uses zero-knowledge encryption, the entire decrypted message (including attachment content and MIME type) is attacker-controlled and can't be inspected or sanitized by the server.

Root cause 1: MIME-gated sanitization (line 3017)

DOMPurify sanitization only triggers when the MIME type matches */^image/.svg/i. Any other active content type (such as text/html, application/xhtml+xml, text/xml) completely bypasses sanitization.

// js/privatebin.js:3017-3023
if (mimeType.match(/^image\/.*svg/i)) {          // only SVG is considered
    const sanitizedData = DOMPurify.sanitize(
        decodedData,
        purifySvgConfig
    );
    blobUrl = getBlobUrl(sanitizedData, mimeType); // reassigns LOCAL variable only
}