CVE-2025-64208

Executive Summary

CVE-2025-64208 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the TieLabs Jannah - Extensions WordPress plugin, affecting versions through 1.1.4. The vulnerability arises from improper neutralization of user-controlled input during web page generation, allowing an attacker to inject malicious scripts that execute in the victim's browser within the context of the WordPress site. Since this is a WordPress plugin, the attack surface is limited to sites running the Jannah theme with the vulnerable extensions module enabled. No public exploit code or proof-of-concept has been released, and the EPSS score is 0.0%, indicating low exploitation activity. However, the lack of a patch from the vendor increases risk for unmaintained installations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and commercial channels. Users who obtained the plugin through legitimate means are at risk if they have not applied any available updates. The absence of a patch from TieLabs means that supply chain integrity is compromised for all versions <= 1.1.4. Administrators should consider removing or replacing the plugin until a fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Script can modify content within the victim's session.
• Availability (A): None (N) – No direct impact on availability.

CVSS Score: 6.5 (Medium)
Threat Level: Medium – Exploitation requires user interaction, but no authentication is needed, and the impact is limited to the client side.

Deep Dive & Mechanics

The vulnerability resides in the jannah-extensions plugin, which extends the functionality of the Jannah WordPress theme. The plugin improperly handles user-supplied input when generating dynamic content in the browser (DOM-based). Specifically, the plugin reads data from document.location, document.URL, or document.referrer and writes it directly into the DOM without proper sanitization or encoding. This allows an attacker to craft a URL containing malicious JavaScript that, when visited by an authenticated administrator or any user, executes in the context of the WordPress admin dashboard or frontend.

The attack flow:

1. Attacker crafts a URL with a malicious payload in a query parameter or fragment identifier.
2. Victim clicks the link (e.g., via phishing email or social engineering).
3. The vulnerable plugin reads the attacker-controlled value from the DOM.
4. The value is inserted into the page without sanitization, causing the browser to execute the injected script.
5. The script can steal session cookies, perform actions on behalf of the victim, or deface the site.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described generically. The plugin likely uses JavaScript code similar to:

// Vulnerable code
var userInput = window.location.hash.substring(1);
document.getElementById('output').innerHTML = userInput;

A patched version would sanitize the input before DOM insertion:

// Patched code
var userInput = window.location.hash.substring(1);
var safeOutput = document.createTextNode(userInput);
document.getElementById('output').appendChild(safeOutput);

Or use a DOMPurify library:

var userInput = window.location.hash.substring(1);
document.getElementById('output').innerHTML = DOMPurify.sanitize(userInput);

Exploitation & Lab Setup

Red Team

Since no public exploit code is available, a proof-of-concept can be constructed. The following HTML/JavaScript demonstrates the vulnerability:

<!-- exploit.html -->
<!DOCTYPE html>
<html>
<body>
<script>
// Simulate the vulnerable plugin behavior
var payload = "<img src=x onerror=alert('XSS')>";
document.write(payload);
</script>
</body>
</html>

To exploit the actual plugin, craft a URL like:

https://victim-site.com/?page_id=123#<img src=x onerror=alert(document.cookie)>

If the plugin reads the fragment identifier and writes it to the DOM, the script executes.

Blue Team

To test for the vulnerability in a lab environment:

1. Set up a WordPress instance with the Jannah theme and jannah-extensions plugin version 1.1.4.
2. Create a page or post that uses the vulnerable extension.
3. Access the page with a crafted URL containing a test payload (e.g., #<script>alert('test')</script>).
4. Observe if the script executes.

Use browser developer tools to inspect the DOM and verify unsanitized input.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing suspicious fragment identifiers or query parameters with script tags (e.g., #<script>, ?x=<img src=x onerror=...>).
• Host: Unexpected JavaScript execution in the browser console, especially in the context of the WordPress admin area.
• Logs: Web server logs showing requests with unusual fragment identifiers (fragments are not sent to the server, so server-side logging may not capture them; client-side monitoring is required).
• File: Modified or injected JavaScript files in the wp-content/plugins/jannah-extensions/ directory (if attacker gains write access).

Detection Engineering

YARA Rule

rule CVE_2025_64208_DOM_XSS {
    meta:
        description = "Detects potential DOM-based XSS in Jannah Extensions plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64208"
    strings:
        $s1 = "window.location" nocase
        $s2 = "document.location" nocase
        $s3 = "innerHTML" nocase
        $s4 = "jannah-extensions" nocase
    condition:
        all of ($s1,$s2,$s3) or ($s4 and any of ($s1,$s2,$s3))
}

Sigma Rule

title: CVE-2025-64208 DOM-Based XSS in Jannah Extensions
id: 8a3f7c2e-1b4d-4f5a-9c8e-0d1e2f3a4b5c
status: experimental
description: Detects potential exploitation attempts of DOM-based XSS in Jannah Extensions plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '#<script'
            - '#<img'
            - '#<svg'
            - '#<iframe'
    condition: selection
falsepositives:
    - Legitimate use of fragment identifiers with HTML-like content (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64208 DOM-Based XSS Attempt"; flow:to_server; content:"#<script"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable or remove the jannah-extensions plugin until a patch is released.
2. Workaround: Implement a Web Application Firewall (WAF) rule to block requests containing suspicious fragment identifiers (e.g., #<script, #<img).
3. Code Fix: The vendor should sanitize all user-controlled input before DOM insertion using textContent or a library like DOMPurify.
4. User Education: Train users to avoid clicking suspicious links, especially those with unusual fragment identifiers.
5. Monitoring: Enable client-side XSS detection in browsers (e.g., XSS Auditor) and monitor for anomalous JavaScript execution.

Valters IT