5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2018-25157

CVE-2018-25157: Phraseanet vulnerable to stored cross-site scripting through crafted file names

Phraseanet 4.0.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through crafted file names during document uploads. Attackers can upload files with embedded SVG scripts that execute in the browser, potentially stealing cookies or redirecting users when the file is viewed.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2018-25157

CVE-2018-25157:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
phraseanet/phraseanet	composer	= 4.0.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in Phraseanet 4.0.3, identified as CVE-2018-25157. The root cause is the application's failure to properly sanitize user-controlled input, specifically filenames, before storing and displaying them. An authenticated attacker could upload a file with a specially crafted name containing malicious JavaScript code. When this file, or its metadata (like the title), is viewed by other users, the embedded script executes in their browser, potentially leading to session hijacking, data theft, or other malicious actions.

My analysis of the patches between the vulnerable version (4.0.3) and the fixed version (4.0.7) reveals several key changes that address this vulnerability:

Input Sanitization: The most direct fix is in lib/Alchemy/Phrasea/Filesystem/LazaretPathBooker.php, where the bookFile function is modified to strip non-alphanumeric characters from filenames using preg_replace. This prevents malicious characters from being saved in the first place.
Output Escaping: Multiple files were patched to apply output escaping. For example, in lib/classes/record/adapter.php, the getTitle function now uses htmlspecialchars to escape the record title before it's displayed. Similarly, in Twig templates like templates/web/prod/results/record.html.twig, the |e filter (which is Twig's auto-escaping mechanism) is added to variables that display record titles and other user-provided data.
Client-Side Encoding: In templates/web/prod/upload/upload.html.twig, the filename is now encoded using encodeURI on the client-side before being sent to the server. This adds another layer of protection.

By identifying these changes, I have pinpointed the functions that were directly involved in the vulnerability. These functions would appear in a runtime profile when the vulnerability is triggered, as they are responsible for processing the malicious input and rendering it in the application.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.