CVE-2025-64094

Executive Summary

CVE-2025-64094 is a stored Cross-Site Scripting (XSS) vulnerability in DNN (formerly DotNetNuke), an open-source web content management platform for the Microsoft ecosystem. The vulnerability arises from incomplete sanitization of SVG file uploads, allowing an attacker to inject malicious scripts that execute in the context of a victim's browser. This issue is a bypass of the previous fix for CVE-2025-48378. The vulnerability affects all versions prior to 10.1.1, where the fix is implemented. The CVSS score is 6.4 (Medium), with a low attack complexity and no privileges required, but user interaction is needed. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a core platform vulnerability in the DNN CMS, which is distributed as a .NET application.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): None – An unauthenticated attacker can upload a malicious SVG file.
• User Interaction (UI): Required – The victim must view the uploaded SVG file.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the lack of authentication requirements and the potential for phishing or session hijacking make this a significant risk for unpatched DNN installations.

Deep Dive & Mechanics

The vulnerability is a stored XSS in the SVG file upload functionality. DNN allows users to upload SVG images, which are then rendered on the site. The previous fix for CVE-2025-48378 attempted to sanitize SVG content but failed to cover all possible XSS vectors. Attackers can craft an SVG file containing malicious JavaScript that bypasses the sanitization filters. When a user views the uploaded SVG (e.g., in a page or profile), the script executes in their browser.

Root Cause: Incomplete input validation and sanitization of SVG content. The application likely uses a blocklist or insufficient parsing to remove dangerous elements like <script> tags or event handlers (e.g., onload, onerror). Attackers can use alternative vectors such as:

• Using <svg><use> with external references.
• Embedding scripts in <style> tags or using CSS expressions.
• Using SVG attributes like xlink:href with javascript: URIs.
• Using <foreignObject> to embed HTML with scripts.

Attack Flow:

1. Attacker registers or gains access to a DNN site with file upload permissions.
2. Attacker uploads a crafted SVG file containing malicious JavaScript.
3. The SVG is stored on the server.
4. Victim (e.g., site administrator or visitor) views the page containing the SVG.
5. The malicious script executes in the victim's browser, potentially stealing cookies, redirecting to phishing sites, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Since the exact code is not publicly available, the following is a conceptual comparison based on the vulnerability description.

Vulnerable Code (Pre-10.1.1):

// Incomplete sanitization - only removes <script> tags
public string SanitizeSvg(string svgContent)
{
    // Removes <script> tags but not other vectors
    svgContent = Regex.Replace(svgContent, @"<script[^>]*>.*?</script>", "", RegexOptions.IgnoreCase | RegexOptions.Singleline);
    return svgContent;
}

Patched Code (10.1.1):

// Comprehensive sanitization using a whitelist approach
public string SanitizeSvg(string svgContent)
{
    // Use a dedicated SVG sanitizer library or more robust parsing
    var sanitizer = new SvgSanitizer();
    return sanitizer.Sanitize(svgContent);
}

The patched version likely uses a dedicated library (e.g., AngleSharp or a custom parser) that removes all potentially dangerous elements and attributes, including event handlers, javascript: URIs, and embedded HTML.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install DNN version 10.0.0 or earlier (e.g., using a local IIS or Docker container).
2. Create a user account with file upload permissions.
3. Prepare a malicious SVG file.

Malicious SVG Example:

<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <rect width="100" height="100" fill="red" onload="alert('XSS')"/>
</svg>

Alternative SVG using <foreignObject>:

<svg xmlns="http://www.w3.org/2000/svg">
  <foreignObject width="100" height="100">
    <div xmlns="http://www.w3.org/1999/xhtml">
      <script>alert('XSS')</script>
    </div>
  </foreignObject>
</svg>

Exploitation Steps:

1. Log in to the DNN site.
2. Navigate to a page where file upload is allowed (e.g., profile picture, file manager).
3. Upload the malicious SVG file.
4. Share the link to the uploaded SVG with the victim (e.g., via email or social engineering).
5. When the victim views the SVG, the script executes.

Blue Team (Defensive)

Detection:

• Monitor file uploads for SVG files with suspicious content.
• Use WAF rules to block SVG files containing <script>, onload, onerror, or javascript: URIs.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search server logs for uploads of .svg files.
• Review database entries for stored SVG content containing suspicious patterns.
• Use the YARA and Sigma rules provided below.

Mitigation:

• Immediately upgrade to DNN 10.1.1 or later.
• If upgrade is not possible, disable SVG file uploads or implement a strict whitelist of allowed file types.
• Use a web application firewall (WAF) to filter malicious SVG uploads.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Example – replace with actual hashes if available)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious SVG)
• Network Indicators:
  • Outbound connections to attacker-controlled domains from the DNN server.
  • HTTP requests containing Content-Type: image/svg+xml with suspicious payloads.
• File System:
  • SVG files in upload directories containing <script>, onload, onerror, or javascript: URIs.
• Log Entries:
  • DNN logs showing file uploads with unusual MIME types or content.

Detection Engineering

YARA Rule

rule Detect_Malicious_SVG_XSS {
    meta:
        description = "Detects SVG files with potential XSS payloads targeting DNN CVE-2025-64094"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64094"
    strings:
        $script = /<script[^>]*>.*?<\/script>/is
        $onload = /onload\s*=/i
        $onerror = /onerror\s*=/i
        $javascript = /javascript\s*:/i
        $foreignobject = /<foreignObject/i
    condition:
        (uint32(0) == 0x3C737667 or uint32(0) == 0x7376673C) and
        (any of ($script, $onload, $onerror, $javascript, $foreignobject))
}

Sigma Rule

title: DNN SVG Upload XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to upload malicious SVG files to DNN CMS
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-64094
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '*/FileUpload*'
        cs-content-type: 'image/svg+xml'
    keywords:
        - '<script'
        - 'onload='
        - 'onerror='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate SVG files with benign scripts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64094 DNN SVG XSS Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/FileUpload"; http_uri; content:"image/svg+xml"; http_content_type; pcre:"/<script[^>]*>.*?<\/script>/i"; pcre:"/onload\s*=/i"; pcre:"/onerror\s*=/i"; pcre:"/javascript\s*:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update DNN to version 10.1.1 or later. This is the only complete fix.
2. Disable SVG Uploads: If upgrade is not immediately possible, disable SVG file uploads in the DNN configuration.
3. WAF Rules: Deploy web application firewall rules to block SVG files containing suspicious content.

Long-Term Measures:

• Implement a Content Security Policy (CSP) that restricts script execution.
• Regularly review and update file upload validation logic.
• Conduct security audits of third-party components.
• Monitor for new CVEs related to DNN and apply patches promptly.

Workarounds:

• Use a reverse proxy to inspect and sanitize uploaded files.
• Restrict file upload permissions to trusted users only.

Valters IT
Securing Digital Frontiers