CVE-2018-25349: userSpice 4.3.24 XSS Vulnerability

CVE-2018-25349 Overview

CVE-2018-25349 is a stored cross-site scripting (XSS) vulnerability in userSpice 4.3.24, a PHP-based user management framework. Attackers can inject malicious JavaScript through the X-Forwarded-For HTTP header when sending requests to the backup.php endpoint. The injected payload is stored in the application's audit log and executes in the browser of any administrator who views that log. The flaw maps to [CWE-79], improper neutralization of input during web page generation. Exploitation requires no authentication, but the payload only fires when a privileged user opens the affected log page.

Critical Impact

Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser session, enabling session theft, account takeover, and unauthorized actions against the userSpice application.

Affected Products

• userSpice 4.3.24
• userSpice 4 series (backup.php endpoint)
• Deployments logging X-Forwarded-For values without sanitization

Discovery Timeline

• 2026-05-23 - CVE-2018-25349 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2018-25349

Vulnerability Analysis

The vulnerability is a stored XSS condition in the userSpice 4.3.24 audit logging pipeline. When a client request reaches backup.php, the application captures the value of the X-Forwarded-For HTTP header and writes it to the audit log without HTML encoding or input validation. When an administrator later opens the audit log view, the stored value is rendered directly into the page DOM. Any JavaScript supplied in the header executes under the administrator's origin and session context.

Because the X-Forwarded-For header is fully attacker-controlled and the backup.php endpoint is reachable without authentication in vulnerable deployments, exploitation requires only a single crafted HTTP request. The attack is asynchronous: it succeeds when a privileged user later reviews the log. The vulnerability is classified under [CWE-79].

Root Cause

The root cause is missing output encoding on user-controllable HTTP header values stored in the audit log. userSpice trusts the X-Forwarded-For header as a benign client identifier and persists it verbatim. The audit log viewer then emits the stored string into HTML context without escaping, allowing <script> tags and event-handler attributes to be parsed by the browser.

Attack Vector

An attacker sends an HTTP request to /users/admin/backup.php with a malicious X-Forwarded-For header containing JavaScript such as a <script> tag or an event handler payload. The application records the header into the audit log. When an administrator visits the audit log page, the browser parses and executes the stored script in the administrator's authenticated session. The attacker can then exfiltrate session cookies, issue privileged API calls, or pivot to further compromise the application. See the Exploit-DB entry #44871 and the VulnCheck Advisory on UserSpice for additional technical context.

Detection Methods for CVE-2018-25349

Indicators of Compromise

• HTTP requests to backup.php containing <script>, onerror=, onload=, or javascript: substrings inside the X-Forwarded-For header.
• Audit log entries in userSpice containing HTML or JavaScript syntax in the client IP field.
• Outbound requests from administrator browsers to attacker-controlled domains shortly after viewing the audit log.
• Unexpected session token usage or administrative actions originating from administrator IP addresses.

Detection Strategies

• Inspect web server access logs for non-IP-formatted values in the X-Forwarded-For header on requests to backup.php.
• Deploy WAF rules that flag header values containing HTML tags, JavaScript keywords, or URL-encoded script payloads.
• Review the userSpice audit log database tables for entries whose IP column contains characters outside the set [0-9a-fA-F:.,\s].

Monitoring Recommendations

• Alert on any HTTP header field that exceeds expected length or contains script-related tokens.
• Correlate administrator browser telemetry with audit log access events to identify script execution following log views.
• Forward web server and userSpice application logs to a centralized analytics platform for retroactive hunting of malformed X-Forwarded-For values.

How to Mitigate CVE-2018-25349

Immediate Actions Required

• Upgrade userSpice to a release later than 4.3.24 that sanitizes the X-Forwarded-For header before storage and rendering.
• Restrict access to backup.php and administrative endpoints by IP allowlist or authentication middleware.
• Audit existing entries in the audit log table and purge or escape any rows containing HTML or JavaScript characters.
• Force a session reset for all administrative accounts after remediation to invalidate any tokens potentially captured via XSS.

Patch Information

No vendor patch URL is listed in the NVD entry for CVE-2018-25349. Administrators should track the userSpice project for releases superseding 4.3.24 and apply the latest available version. Until then, treat all X-Forwarded-For data as untrusted and apply the workarounds below.

Workarounds

• Configure the upstream reverse proxy or load balancer to overwrite the X-Forwarded-For header with a validated client IP before requests reach userSpice.
• Apply a Content Security Policy (CSP) that disallows inline scripts on administrative pages to neutralize injected payloads.
• Add server-side filtering that rejects requests where X-Forwarded-For does not match a strict IPv4 or IPv6 regular expression.
• HTML-encode all audit log fields at render time using htmlspecialchars() with ENT_QUOTES and a UTF-8 charset.

# Example nginx configuration enforcing a validated client IP
map $http_x_forwarded_for $sanitized_xff {
    default "";
    "~^(?<ip>(\d{1,3}\.){3}\d{1,3})$" $ip;
}

server {
    location /users/admin/backup.php {
        proxy_set_header X-Forwarded-For $sanitized_xff;
        proxy_pass http://userspice_backend;
    }
}