CVE-2025-63419

Executive Summary

CVE-2025-63419 is a Cross-Site Scripting (XSS) vulnerability identified in CrushFTP version 11.3.6_48. The flaw resides in the Web-Based Server's file sharing feature, where the filename is reflected into an email body field without proper sanitization. This allows an attacker to inject arbitrary HTML or JavaScript, leading to potential session hijacking, credential theft, or defacement. The vulnerability is unpatched as of the latest advisory, and no official patch has been released. The CVSS score is 0.0 due to incomplete scoring data, but the vector indicates a medium severity with network access, low complexity, and user interaction required.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone application vulnerability in CrushFTP, a file transfer server. No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Incomplete scoring; estimated medium based on vector)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium (due to user interaction requirement but low complexity)

Deep Dive & Mechanics

The vulnerability exists in the file sharing functionality of CrushFTP's web interface. When a user shares a file, the filename is included in an email body field that is sent to recipients. The application fails to sanitize or encode the filename before reflecting it into the HTML email body. An attacker can craft a malicious filename containing HTML or JavaScript payloads. When the email is viewed in an HTML-capable client, the payload executes in the context of the recipient's browser.

The attack flow:

1. Attacker uploads a file with a malicious filename (e.g., <script>alert('XSS')</script>.txt).
2. Attacker uses the share feature to send an email to a victim.
3. Victim receives the email and views it in an HTML email client.
4. The malicious script executes, potentially stealing cookies, redirecting to phishing sites, or performing actions on behalf of the victim.

The root cause is the lack of output encoding in the email body generation code. The filename is directly concatenated into the email template without HTML entity encoding.

Vulnerable vs. Patched Code

Vulnerable Code (CrushFTP 11.3.6_48):

// Email body generation
String emailBody = "File shared: " + filename + " from " + sender;
// No sanitization of filename

Patched Code (Hypothetical):

// Email body generation with sanitization
String safeFilename = StringEscapeUtils.escapeHtml4(filename);
String emailBody = "File shared: " + safeFilename + " from " + sender;

The vulnerable code directly uses the user-supplied filename without any encoding. The patched code would use HTML entity encoding to neutralize any HTML/JavaScript.

Exploitation & Lab Setup

Red Team

Prerequisites:

• CrushFTP 11.3.6_48 instance
• Network access to the web interface
• Ability to upload files

Exploitation Steps:

1. Upload a file with a malicious filename, e.g., <img src=x onerror=alert(1)>.txt.
2. Use the share feature to send an email to a victim.
3. The victim views the email, triggering the XSS.

Proof of Concept (PoC):

# Using curl to upload a file with malicious filename
curl -X POST -F "file=@/dev/null;filename=<script>alert('XSS')</script>.txt" http://target:8080/upload

Note: No public exploit code is available from Exploit-DB.

Blue Team

Detection Steps:

1. Monitor for filenames containing HTML tags or JavaScript patterns in upload logs.
2. Inspect email logs for unusual filenames.
3. Use web application firewall (WAF) rules to block malicious filenames.

Hunting Queries:

• Search for filenames containing <script, <img, onerror, onload, etc.
• Look for emails sent with filenames that include HTML entities.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with filenames containing HTML tags (e.g., <script>, <img>)
  • Email headers with suspicious filenames in the subject or body
• File IOCs:
  • Files with names containing HTML/JavaScript payloads
• Log IOCs:
  • Application logs showing filenames with HTML characters
  • Email logs with unusual filenames

Detection Engineering

YARA Rule

rule CVE_2025_63419_XSS_Filename {
    meta:
        description = "Detects malicious filenames used in CVE-2025-63419 XSS attack"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63419"
    strings:
        $html_tag = /<[^>]+>/
        $js_event = /on\w+\s*=\s*['"]?[^'"]*['"]?/
    condition:
        any of ($html_tag) or any of ($js_event)
}

Sigma Rule

title: CVE-2025-63419 XSS via Malicious Filename in CrushFTP
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects filenames containing HTML/JavaScript in CrushFTP upload logs
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: crushftp
detection:
    selection:
        filename|contains:
            - '<script'
            - '<img'
            - 'onerror'
            - 'onload'
            - 'onclick'
    condition: selection
falsepositives:
    - Legitimate filenames with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-63419 CrushFTP XSS via Malicious Filename"; flow:to_server; content:"filename="; nocase; pcre:"/filename=[^&]*<[^>]+>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the file sharing feature if not required.
2. Implement input validation on filenames to block HTML/JavaScript characters.
3. Apply output encoding in the email body generation code.

Long-term Fix:

• Upgrade to a patched version once available.
• Implement a web application firewall (WAF) with rules to block XSS payloads in filenames.

Workarounds:

• Use a reverse proxy to sanitize filenames before they reach CrushFTP.
• Restrict file uploads to trusted users only.

Valters IT