CVE-2025-32951

Executive Summary

CVE-2025-32951 is a stored Cross-Site Scripting (XSS) vulnerability in the Jmix framework, a set of libraries and tools for Spring Boot data-centric application development. The vulnerability arises from improper Content-Type handling when serving uploaded files. An attacker can manipulate the file path/name parameter to force the server to return a Content-Type header of text/html if the filename ends with .html. This allows malicious JavaScript code embedded in an uploaded file to be executed in the victim's browser when the file is accessed.

The vulnerability affects Jmix versions 1.0.0 through 1.6.1 and 2.0.0 through 2.3.4. It has been patched in versions 1.6.2 and 2.4.0. A workaround is available on the Jmix documentation website. The CVSS score is 6.4 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

Jmix is distributed as a set of libraries and tools for Spring Boot. The vulnerability is in the core framework, not in a specific package manager. However, organizations using Jmix should verify their dependency versions and apply patches or workarounds as soon as possible. The risk is moderate, as exploitation requires an attacker to first upload a malicious file.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker needs to be able to upload a file.
• User Interaction (UI): Required (R) - The victim must access the malicious file.
• Scope (S): Changed (C) - The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited information disclosure.
• Integrity (I): Low (L) - Limited data modification.
• Availability (A): Low (L) - Limited service disruption.

Threat Level: Medium. The vulnerability requires user interaction and prior file upload, but can lead to session hijacking, data theft, or defacement.

Deep Dive & Mechanics

The vulnerability is in the file serving mechanism of Jmix. When a user requests a file, the application determines the Content-Type header based on the file extension. The flaw is that the input parameter, which includes the file path and name, can be manipulated. If the filename ends with .html, the server returns Content-Type: text/html. This allows an attacker to upload a file containing malicious JavaScript (e.g., a .txt file with HTML content) and then access it with a manipulated path that ends in .html. The browser then interprets the file as HTML and executes the embedded script.

Root Cause: Improper validation of the file path/name parameter when determining the Content-Type header. The application does not sanitize the filename to prevent the .html extension from being appended or manipulated.

Attack Flow:

1. Attacker uploads a malicious file (e.g., malicious.txt) containing JavaScript payload.
2. Attacker crafts a URL that points to the uploaded file but with a manipulated path ending in .html (e.g., /files/malicious.txt.html).
3. Victim clicks the crafted URL.
4. Server returns the file content with Content-Type: text/html.
5. Browser executes the JavaScript payload.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Uses filename extension directly to set Content-Type
public ResponseEntity<Resource> getFile(String filePath) {
    Resource file = storageService.load(filePath);
    String contentType = determineContentType(filePath); // e.g., based on extension
    return ResponseEntity.ok()
            .contentType(MediaType.parseMediaType(contentType))
            .body(file);
}

Patched Code (Conceptual):

// Patched: Validates and sanitizes the file path, and uses the actual file's content type
public ResponseEntity<Resource> getFile(String filePath) {
    // Sanitize filePath to prevent manipulation
    String sanitizedPath = sanitizeFilePath(filePath);
    Resource file = storageService.load(sanitizedPath);
    // Use the actual file's content type, not the extension
    String contentType = probeContentType(file);
    if (contentType == null) {
        contentType = "application/octet-stream";
    }
    return ResponseEntity.ok()
            .contentType(MediaType.parseMediaType(contentType))
            .body(file);
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to upload files to the Jmix application.
• Knowledge of the file storage path.

Steps:

1. Create a malicious file payload.txt with content:

   <script>alert('XSS');</script>
   

2. Upload the file via the application's file upload functionality.
3. Note the uploaded file's ID or path (e.g., /files/12345/payload.txt).
4. Craft the exploit URL by appending .html to the filename:

   http://target.com/files/12345/payload.txt.html
   

5. Send the URL to the victim (e.g., via phishing email).

Expected Result: When the victim accesses the URL, the browser executes the JavaScript.

Blue Team (Defender)

Detection:

• Monitor for file uploads with suspicious content (e.g., files containing <script> tags).
• Monitor for requests to file paths that end with .html but reference non-HTML files.
• Use WAF rules to block requests where the file extension is manipulated.

Prevention:

• Apply the patch or workaround provided by Jmix.
• Implement strict Content-Type validation on file serving endpoints.
• Use Content Security Policy (CSP) headers to mitigate XSS.

Indicators of Compromise (IOCs)

• File Path Manipulation: URLs containing file paths that end with .html but reference files with different extensions (e.g., .txt.html, .pdf.html).
• Suspicious File Uploads: Files containing HTML/JavaScript content uploaded with non-HTML extensions.
• Server Logs: HTTP requests with Content-Type: text/html for files that are not HTML.
• Network Traffic: Outbound connections from the victim's browser to attacker-controlled domains (if the payload exfiltrates data).

Detection Engineering

YARA Rule

rule CVE_2025_32951_Jmix_XSS {
    meta:
        description = "Detects malicious files uploaded to exploit CVE-2025-32951"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32951"
    strings:
        $html_tag = /<[^>]*script[^>]*>/
        $html_body = /<html[^>]*>/
        $js_event = /on\w+\s*=\s*['"]/
    condition:
        any of ($html_tag, $html_body, $js_event) and
        filesize < 1MB
}

Sigma Rule

title: CVE-2025-32951 Jmix File Path Manipulation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with manipulated file paths ending in .html
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '.html'
        cs-uri-query|endswith: '.html'
        sc-status: 200
        cs-content-type: 'text/html'
    condition: selection
falsepositives:
    - Legitimate HTML files
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32951 Jmix XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:".html"; http_uri; pcre:"/\.html$/"; content:"text/html"; http_server_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Jmix to version 1.6.2 or 2.4.0 (or later).
2. Workaround: If patching is not possible, implement the workaround provided on the Jmix documentation website. This typically involves configuring the file serving endpoint to always return a safe Content-Type (e.g., application/octet-stream) or to validate the file path.

Long-term Measures:

• Implement strict input validation for all file path parameters.
• Use a whitelist of allowed file extensions for Content-Type determination.
• Deploy a Web Application Firewall (WAF) with rules to detect and block file path manipulation.
• Educate users about the risks of opening files from untrusted sources.

Valters IT Signature: This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at valters@example.com.