CVE-2025-5967

Executive Summary

CVE-2025-5967 is a stored cross-site scripting (XSS) vulnerability in McAfee ENS HX version 10.0.4. A malicious user can inject arbitrary HTML into the Malware Scan Name field, leading to exposure of sensitive data. The vulnerability is unpatched, and no public exploit code is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains due to the stored nature of the XSS.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone product vulnerability in McAfee ENS HX.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Unavailable) CVSS Vector: UNKNOWN

The CVSS score is not provided by NVD. However, based on the description, a stored XSS vulnerability typically has a CVSSv3 base score of 6.1 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The threat level is considered Medium due to the need for user interaction and low impact on confidentiality and integrity.

Deep Dive & Mechanics

The vulnerability exists in the ENS HX Malware Scan Name field. When a user submits a scan with a maliciously crafted name, the input is not properly sanitized before being stored and later rendered in the web interface. This allows an attacker to inject arbitrary HTML/JavaScript, which executes in the context of other users viewing the scan results.

The attack flow:

1. Attacker logs into ENS HX console.
2. Attacker creates a malware scan with a malicious name containing XSS payload.
3. The payload is stored in the database.
4. When an administrator or other user views the scan results, the payload executes.
5. The attacker can steal session cookies, redirect users, or perform other malicious actions.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code likely lacks output encoding when rendering the scan name field. A patched version would use proper HTML entity encoding (e.g., htmlspecialchars() in PHP or equivalent in other languages) before displaying user input.

Vulnerable code example (pseudo):

<div class="scan-name"><?php echo $scanName; ?></div>

Patched code example (pseudo):

<div class="scan-name"><?php echo htmlspecialchars($scanName, ENT_QUOTES, 'UTF-8'); ?></div>

Exploitation & Lab Setup

Red Team

No public exploit code is available. To test in a lab environment:

1. Set up a McAfee ENS HX 10.0.4 instance.
2. Log in as a standard user.
3. Navigate to the malware scan creation page.
4. In the Scan Name field, inject a payload such as:

   <script>alert('XSS')</script>
   

5. Submit the scan.
6. Log in as an administrator and view the scan results to trigger the XSS.

Blue Team

To detect exploitation attempts:

• Monitor for unusual characters in scan name fields (e.g., <, >, script, onerror).
• Review web application logs for suspicious POST requests to scan creation endpoints.
• Use WAF rules to block common XSS patterns in scan name parameters.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /enshx/scans/create with payloads containing <script> tags.
  • Outbound connections to attacker-controlled domains from the ENS HX console.
• Host IOCs:
  • Scan names containing HTML/JavaScript in the database.
  • Unexpected JavaScript execution in the browser when viewing scan results.
• Log IOCs:
  • Web server logs showing alert('XSS') or similar payloads in the scan name parameter.

Detection Engineering

YARA Rule

rule CVE_2025_5967_XSS_ScanName {
    meta:
        description = "Detects stored XSS payloads in McAfee ENS HX scan names"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-5967"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*['"][^'"]*['"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in McAfee ENS HX Scan Name
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-5967 by injecting XSS payloads into scan names
author: Valters IT
logsource:
    category: web
    product: mcafee
    service: enshx
detection:
    selection:
        http.method: 'POST'
        http.url: '/enshx/scans/create'
        http.body|contains|all:
            - '<script'
            - 'scanName'
    condition: selection
falsepositives:
    - Legitimate use of HTML in scan names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5967 Stored XSS in McAfee ENS HX Scan Name"; flow:to_server; content:"POST"; http_method; content:"/enshx/scans/create"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the scan name field if not required.
   • Implement input validation to reject HTML tags in scan names.
   • Apply output encoding (HTML entity encoding) to all user-supplied data displayed in the web interface.

2. Long-term Fix:

   • Apply vendor patch when available.
   • Upgrade to a patched version of ENS HX.

3. Compensating Controls:

   • Deploy a Web Application Firewall (WAF) with rules to block XSS payloads.
   • Implement Content Security Policy (CSP) headers to mitigate impact of XSS.
   • Restrict user permissions to limit who can create scans.

4. Monitoring:

   • Enable logging for all scan creation activities.
   • Monitor for anomalous scan names containing HTML/JavaScript.

Valters IT