CVE-2025-2977: GFI Kerio Connect XSS Vulnerability

CVE-2025-2977 Overview

CVE-2025-2977 is a cross-site scripting (XSS) vulnerability in GFI Kerio Connect 10.0.6. The flaw resides in the PDF File Handler component and allows remote attackers to inject arbitrary script content. Exploitation requires low privileges and user interaction, such as opening a crafted PDF attachment through the webmail interface. The vulnerability is classified under [CWE-79]. The vendor, GFI, was contacted prior to disclosure but did not respond, and a proof-of-concept has been published publicly.

Critical Impact
An authenticated attacker can execute arbitrary JavaScript in the context of a Kerio Connect webmail user, enabling session data theft and unauthorized actions within the mail client.

Affected Products

GFI Kerio Connect 10.0.6
PDF File Handler component within Kerio Connect webmail
Deployments exposing the Kerio Connect web interface to end users

Discovery Timeline

2025-03-31 - CVE-2025-2977 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2977

Vulnerability Analysis

The vulnerability exists in how Kerio Connect processes PDF file content within its webmail interface. When a user interacts with a maliciously crafted PDF, the application fails to properly sanitize embedded content before rendering it in the browser context. This allows script content to execute within the authenticated user's session.

The attack is network-reachable and requires a user to open or preview the attachment. Because the injected script runs in the origin of the Kerio Connect webmail application, an attacker can access session tokens, mailbox content, and any functionality available to the victim. The vulnerability is classified under [CWE-79], Improper Neutralization of Input During Web Page Generation.

Root Cause

The root cause is insufficient output encoding and sanitization of PDF-derived content by the PDF File Handler component. Untrusted data extracted from PDF files is reflected into the DOM without adequate contextual escaping, allowing HTML and JavaScript payloads embedded in a PDF to execute in the browser.

Attack Vector

An attacker with a valid low-privileged Kerio Connect account, or one who can deliver a crafted PDF to a victim, sends a message containing the malicious file. When the recipient opens the attachment through the Kerio Connect web client, the embedded script executes in the webmail origin. The published proof-of-concept demonstrates portable data exfiltration from the mailbox context. Refer to the GitHub PoC Repository for technical details.

Detection Methods for CVE-2025-2977

Indicators of Compromise

Inbound email messages containing PDF attachments with embedded JavaScript, /JS, /JavaScript, or /OpenAction objects.
Outbound HTTP or DNS requests from webmail sessions to attacker-controlled domains shortly after PDF interaction.
Unexpected mailbox activity such as forwarding rules, message reads, or export operations tied to a single web session.

Detection Strategies

Inspect PDF attachments at the mail gateway for active content and dynamic script objects before delivery.
Correlate Kerio Connect webmail access logs with attachment access events to identify anomalous script-driven behavior.
Monitor browser telemetry for script execution originating from Kerio Connect origins that references external endpoints.

Monitoring Recommendations

Enable verbose logging on the Kerio Connect web component and forward events to a centralized SIEM for correlation.
Track authentication anomalies, including concurrent sessions and unexpected client IP changes for accounts that opened suspicious PDFs.
Baseline typical attachment mimetypes and alert on PDFs containing embedded JavaScript actions.

How to Mitigate CVE-2025-2977

Immediate Actions Required

Restrict inline preview of PDF attachments in the Kerio Connect web client where feasible and require download-then-open workflows.
Enforce a strict Content Security Policy (CSP) on the Kerio Connect webmail origin to limit script execution sources.
Block or quarantine inbound PDFs containing active JavaScript objects at the mail security gateway.
Notify users to avoid opening unexpected PDF attachments from unknown or unverified senders.

Patch Information

At the time of publication no vendor patch has been released. GFI did not respond to the disclosure attempt referenced by the reporter. Administrators should monitor the GFI Kerio Connect advisories page and the VulDB entry #302029 for updates.

Workarounds

Disable or restrict the PDF File Handler preview functionality until a vendor fix is available.
Route inbound mail through a security gateway that strips or sanitizes active PDF content, including /JS and /OpenAction entries.
Place the Kerio Connect web interface behind a reverse proxy that enforces CSP headers such as default-src 'self'; script-src 'self'.
Limit webmail access to trusted network ranges or require VPN access to reduce exposure to opportunistic attackers.

bash

# Example reverse proxy header hardening (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "no-referrer" always;