CVE-2025-7953

Executive Summary

CVE-2025-7953 is a publicly disclosed, low-severity open redirect vulnerability affecting Sanluan PublicCMS up to version 5.202506.a. The flaw resides in the viewer.html file of the PDF.js plugin, where the File argument is not properly sanitized, allowing an attacker to redirect users to arbitrary external URLs. While the CVSS score is 3.5 (Low), the open redirect can be leveraged in phishing campaigns or to bypass URL-based security controls. A patch is available via commit f1af17af004ca9345c6fe4d5936d87d008d26e75. No public exploit code or Nuclei template has been released, but the vulnerability is trivial to exploit manually.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (redirect to malicious site)
• Availability Impact: None

Threat Level: Low. The vulnerability requires user interaction and does not directly compromise the server. However, it can be used as a component in larger social engineering attacks.

Deep Dive & Mechanics

The vulnerability exists in the PDF.js viewer component included with PublicCMS. The file publiccms-parent/publiccms/src/main/webapp/resource/plugins/pdfjs/viewer.html accepts a File parameter to load a PDF document. Due to insufficient validation, an attacker can supply a URL to an external site instead of a PDF file. When a user visits a crafted link, the viewer attempts to load the external URL, effectively performing an open redirect.

Root Cause: The File parameter is used directly in a redirect or resource loading context without checking if the URL is within the application's domain or a valid PDF resource.

Attack Scenario:

1. Attacker crafts a URL: https://victim.com/resource/plugins/pdfjs/viewer.html?file=https://evil.com/phishing
2. Victim clicks the link, thinking it leads to a legitimate PDF.
3. The viewer redirects the victim to https://evil.com/phishing, which may host a fake login page or malware.

Vulnerable vs. Patched Code

Vulnerable Code (viewer.html):

// Vulnerable: No validation of the 'file' parameter
var file = getParameterByName('file');
PDFViewerApplication.open({ url: file });

Patched Code (after commit f1af17af):

// Patched: Validate that the file parameter is a relative path or same-origin URL
var file = getParameterByName('file');
if (file && !file.startsWith('http://') && !file.startsWith('https://')) {
    PDFViewerApplication.open({ url: file });
} else {
    console.error('Invalid file parameter');
}

The patch adds a check to reject absolute URLs, ensuring only relative paths (internal PDFs) are loaded.

Exploitation & Lab Setup

Red Team (Exploitation)

Manual Exploitation:

1. Identify a PublicCMS instance (e.g., https://target.com).
2. Craft the malicious URL:

   https://target.com/resource/plugins/pdfjs/viewer.html?file=https://attacker-controlled.com/malicious
   

3. Send the link to the victim via email or social engineering.
4. The victim is redirected to the attacker's site.

Automated Scanning: Use curl to test:

curl -v "https://target.com/resource/plugins/pdfjs/viewer.html?file=https://evil.com"

If the response redirects to evil.com, the instance is vulnerable.

Blue Team (Detection & Hardening)

Detection:

• Monitor web logs for requests to /resource/plugins/pdfjs/viewer.html with a file parameter containing external domains.
• Alert on any redirects from the PDF viewer to external URLs.

Hardening:

• Apply the patch immediately.
• Implement a Web Application Firewall (WAF) rule to block requests where the file parameter contains http:// or https://.
• Restrict the PDF viewer to only serve files from a whitelisted directory.

Indicators of Compromise (IOCs)

• URL Pattern: */resource/plugins/pdfjs/viewer.html?file=*
• Suspicious Parameters: file parameter containing external URLs (e.g., https://, http://)
• Log Entries: HTTP 302 redirects from the PDF viewer to external domains.
• Network Traffic: Outbound connections from the server to unknown external hosts initiated by the PDF viewer.

Detection Engineering

YARA Rule

rule CVE_2025_7953_Open_Redirect {
    meta:
        description = "Detects open redirect in PublicCMS PDF.js viewer"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-7953"
    strings:
        $vuln_code = "PDFViewerApplication.open({ url: file })"
        $file_param = "getParameterByName('file')"
    condition:
        $vuln_code and $file_param
}

Sigma Rule

title: PublicCMS PDF.js Open Redirect
id: cve-2025-7953
status: experimental
description: Detects exploitation attempts of CVE-2025-7953
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/resource/plugins/pdfjs/viewer.html?file=http"
    condition: selection
falsepositives:
    - Legitimate use of external PDF URLs (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7953 PublicCMS Open Redirect"; flow:to_server,established; content:"/resource/plugins/pdfjs/viewer.html"; http_uri; content:"file=http"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the patch from commit f1af17af004ca9345c6fe4d5936d87d008d26e75.
2. If patching is not possible, disable the PDF.js viewer by removing or restricting access to viewer.html.
3. Add a WAF rule to block requests with file parameter containing external URLs.

Long-Term Measures:

• Conduct a code review of all third-party plugins for similar vulnerabilities.
• Implement input validation for all URL parameters.
• Use Content Security Policy (CSP) headers to restrict resource loading.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.