CVE-2025-71430

Executive Summary

CVE-2025-71430 is a stored cross-site scripting (XSS) vulnerability in the Frappe application framework affecting versions before 14.99.10 and 15.x before 15.91.1. The flaw exists in the leaderboard page, where user-supplied names are rendered without proper output neutralization, allowing any authenticated attacker to persist a malicious JavaScript payload that executes in the browsers of other users viewing the leaderboard. With a CVSS base score of 5.4 (Medium), the vulnerability requires low privileges and user interaction, but its scope change (S:C) means impact propagates beyond the vulnerable component to other users' browsers.

Technical Analysis

The vulnerability resides in the leaderboard rendering logic of Frappe, an open-source full-stack web framework used for building enterprise applications (commonly associated with ERPNext). The leaderboard page aggregates and displays user-related ranking data, including user names. According to the NVD description, user names are rendered "without proper neutralization" — meaning that when a user's name is stored and subsequently reflected into the HTML of the leaderboard page, HTML/JavaScript metacharacters are not escaped or encoded.

In CWE-79 (Improper Neutralization of Input During Web Page Generation), the stored variant occurs when attacker-controlled data is persisted server-side and later rendered to other users without contextual output encoding. The relevant context here is an HTML element context (text or attribute) where a user's name is interpolated directly into the DOM. Because the payload is stored, it is not a one-time reflected attack; it executes every time any user loads the leaderboard view until the malicious name is removed or sanitized.

Entry point: an authenticated user sets a crafted user name (or the field mapped to the display name) through the profile/settings interface, which is a standard authenticated action that requires no elevated privileges. Sink: the leaderboard page rendering path outputs that name into HTML without applying HTML entity encoding or a Content Security Policy strong enough to block inline script. The CVSS vector confirms network accessibility (AV:N), low attack complexity (AC:L), low privileges required (PR:L), and required user interaction (UI:R) — the victim must view the leaderboard. The scope change (S:C) and low confidentiality and integrity impacts (C:L/I:L) reflect that the attacker can read or alter data available to the victim's authenticated session in the browser, but cannot directly achieve full server compromise.

No specific function names, class names, routes, or parameter names for the vulnerable render path are provided in the available intelligence; further code-level detail is not derivable from the supplied data.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (stored XSS) and the NVD description.

1. Reconnaissance / target identification: The attacker identifies a Frappe-based instance running an affected version (before 14.99.10, or 15.x before 15.91.1). Leaderboard features are commonly exposed to authenticated users in Frappe/ERPNext deployments, so the attacker obtains valid low-privilege credentials (e.g., a standard user account) and locates the leaderboard page.

2. Triggering the flaw class: As an authenticated user, the attacker opens their profile/name configuration and sets a user name containing an HTML/JavaScript payload. Because the name value is stored server-side and the leaderboard render path does not neutralize it, the payload persists in the application database as the attacker's display name.

3. Payload / execution method: When any other user (including higher-privileged users or administrators) loads the leaderboard page, the crafted name is emitted into the HTML without encoding. The browser parses the injected markup and executes the embedded JavaScript in the context of the Frappe application origin, under the victim's session. The attacker does not need to deliver a link directly; viewing the leaderboard is sufficient.

4. Post-exploitation impact: Executed script runs same-origin with the victim's session. Typical outcomes for this class include session/token theft or abuse, performing authenticated actions on the victim's behalf (CSRF-like via same-origin requests), exfiltrating data visible to the victim, or redirecting the victim to attacker-controlled content. The scope-change rating reflects that the malicious script affects resources beyond the vulnerable component.

Impact Assessment

The CVSS 3.1 base score is 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Network accessibility combined with low complexity and low privileges makes the barrier to exploitation modest: any authenticated user can plant the payload. The requirement for user interaction (the victim must view the leaderboard) constrains mass exploitation but is trivially satisfied in deployments where leaderboards are routinely viewed.

Confidentiality and integrity impacts are rated Low, and no availability impact is reported. However, the scope change means the vulnerability's effect crosses a security boundary, allowing the injected script to act on other users' authenticated sessions in the same origin. In Frappe/ERPNext environments, sessions frequently contain access to business data, and administrator accounts viewing the leaderboard represent a high-value target — an XSS payload executing under an admin session can pivot toward broader application control. Blast radius scales with the number of users who view the leaderboard; persistence means remediation requires not only patching but also identifying and removing stored malicious payloads.

Detection Guidance

Sigma Rule

title: Potential Stored XSS via Frappe Leaderboard User Name
id: 8f3a2c1e-5b7d-4e9a-9c2f-1a6d4e7b0c33
status: experimental
description: Detects HTTP requests that submit user name values containing HTML/JavaScript metacharacters, indicative of stored XSS persistence in Frappe leaderboard (CVE-2025-71430).
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
  selection_payload:
    - 'cs-uri-query|contains':
        - 'name='
        - 'full_name='
    - 'cs-uri-query|re': '(?i)(%3Cscript|<script|onerror=|onload=|javascript:|%3Cimg|<img)'
  condition: selection_method and selection_payload
fields:
  - c-ip
  - cs-uri
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate names containing angle brackets (rare)
  - Security scanners and fuzzers
level: medium
tags:
  - attack.t1059.007
  - cve.2025.71430
  - cwe.79

YARA Rule

rule CVE_2025_71430_Frappe_Stored_XSS
{
    meta:
        description = "Detects stored XSS payload markers in Frappe leaderboard/user name data related to CVE-2025-71430"
        author = "Threat Intelligence"
        date = "2025-01-01"
        reference = "CVE-2025-71430"
        cve = "CVE-2025-71430"

    strings:
        $xss1 = "<script" nocase
        $xss2 = "</script>" nocase
        $xss3 = "onerror=" nocase
        $xss4 = "onload=" nocase
        $xss5 = "javascript:" nocase
        $xss6 = "<img" nocase
        $xss7 = "<svg" nocase
        $leo = "leaderboard" nocase
        $frappe = "frappe" nocase

    condition:
        (uint16(0) == 0x3C3F or uint16(0) == 0x7B0A) and
        (($xss1 or $xss2 or $xss3 or $xss4 or $xss5 or $xss6 or $xss7) and
         $frappe) or
        (($leo and $frappe) and any of ($xss*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-71430 Frappe Leaderboard Stored XSS User Name Payload"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"frappe"; nocase; http.request_body; content:"<script"; nocase; http.request_body; content:"name"; nocase; classtype:web-application-attack; reference:cve,2025-71430; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2025-71430; sid:202571430; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and
      http.request.method in ("POST","PUT","PATCH") and
      url.path : "*frappe*" and
      url.query : ("*name=*", "*full_name=*") and
      url.query : ("*<script*", "*%3Cscript*", "*onerror=*", "*javascript:*") ]
  [ network where network.protocol == "http" and
      http.response.status_code == 200 ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval combined = urldecode(_raw)
| where (match(combined, "(?i)(name=|full_name=)"))
| where (match(combined, "(?i)(%3Cscript|<script|%3Cimg|<img|onerror=|onload=|javascript:)"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, http_user_agent
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,frappe,">
  <rule id="100714" level="10">
    <if_sid>31100</if_sid>
    <url>name=|full_name=</url>
    <regex type="pcre2">(?i)(%3Cscript|<script|onerror=|onload=|javascript:|%3Cimg)</regex>
    <description>CVE-2025-71430: Possible stored XSS payload submitted via Frappe user name field</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2025_71430,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version package mapping is present in tracked intelligence. The NVD description references fixed versions 14.99.10 and 15.91.1; these version identifiers are taken verbatim from the description and should be validated against the Frappe release notes before relying on them.

1. Immediate mitigations:

   • Deploy a restrictive Content Security Policy (CSP) that disallows inline script (e.g., script-src without 'unsafe-inline'), which can neutralize inline XSS execution even when output encoding is missing.
   • Restrict access to leaderboard views to trusted user groups where possible, or disable leaderboard features that render user names until a fix is applied.
   • Search stored user name fields for HTML/JavaScript metacharacters and remediate any suspicious entries; constrain name input validation on the profile update path.
   • Apply server-side output encoding to any user-controlled value rendered on the leaderboard (contextual HTML entity encoding) as a compensating control.

2. Patch / upgrade steps:

   • Track the Frappe project release channel for the versions referenced in the NVD description (14.99.10 on the v14 branch; 15.91.1 on the v15 branch) and upgrade once an official patch is confirmed.
   • Because no patch evidence exists in tracked sources, do not assume availability; verify against the official repository and release notes before upgrading.
   • Back up the database prior to upgrade, and after upgrading, re-scan stored user names for residual payloads.

3. Long-term hardening:

   • Adopt a templating/rendering practice that applies contextual auto-escaping by default across the framework.
   • Enforce a strict CSP and set HttpOnly, Secure, and SameSite attributes on session cookies to limit the value of any XSS that still occurs.
   • Add input validation and output-encoding unit tests to CI for all user-controlled fields rendered in views such as leaderboards.
   • Monitor leaderboard and profile-update endpoints for payload submission patterns using the detection rules above.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-71430
• CWE-79 (Improper Neutralization of Input During Web Page Generation): https://cwe.mitre.org/data/definitions/79.html
• Frappe Framework project repository and release notes (verify fixed versions 14.99.10 / 15.91.1): https://github.com/frappe/frappe
• OWASP Cross Site Scripting Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
• CISA Known Exploited Vulnerabilities catalog (verify status — not currently listed per provided data): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or exploit-in-the-wild evidence was identified in the provided intelligence. No known threat actor campaigns are associated with this CVE in the supplied data.