CVE-2025-4551: ContiNew Admin XSS Vulnerability

CVE-2025-4551 Overview

CVE-2025-4551 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in ContiNew Admin versions up to 3.6.0. The flaw resides in the /dev-api/common/file endpoint, where the File argument is not properly sanitized before rendering. Attackers with low privileges can inject malicious script content that executes in the browser context of other users. The vendor did not respond to disclosure attempts, and the exploit has been publicly disclosed.

Critical Impact
An authenticated remote attacker can inject persistent JavaScript payloads through the file upload interface, enabling session hijacking, credential theft, and administrative action abuse against ContiNew Admin users.

Affected Products

ContiNew Admin versions up to and including 3.6.0
The vulnerable component: /dev-api/common/file endpoint
Deployments exposing the ContiNew Admin web interface to authenticated users

Discovery Timeline

2025-05-11 - CVE-2025-4551 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4551

Vulnerability Analysis

CVE-2025-4551 is a stored cross-site scripting vulnerability affecting the ContiNew Admin management application. The flaw exists in an unspecified function that processes the File parameter submitted to /dev-api/common/file. The application stores attacker-controlled input and reflects it back to users without adequate output encoding or input sanitization.

Because the payload persists server-side, every user who loads the affected view executes the injected script within their authenticated session. Attackers can leverage this to steal session cookies, perform actions on behalf of victims, or pivot to further compromise administrative accounts. Exploitation requires user interaction and low-level authentication, but the attack is executed remotely over the network.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The /dev-api/common/file endpoint accepts the File argument and stores its value without applying HTML entity encoding or a strict content validation policy. When the stored value is later rendered in the administrative interface, the browser interprets embedded <script> tags or event handler attributes as executable code.

Attack Vector

An authenticated attacker sends a crafted request to /dev-api/common/file, manipulating the File argument to include JavaScript payloads. The malicious value is persisted in the application's data store. When another user, typically an administrator, browses to a page that displays the stored file metadata, the injected script executes in their browser under the ContiNew Admin origin. This grants the attacker access to session tokens, CSRF tokens, and any state accessible to the victim's session.

No verified proof-of-concept code has been published beyond the technical write-up referenced by the GitHub Stored XSS Vulnerability advisory.

Detection Methods for CVE-2025-4551

Indicators of Compromise

HTTP requests to /dev-api/common/file containing HTML tags, JavaScript keywords, or URL-encoded script fragments in the File parameter
Stored file records whose names or metadata fields contain <script>, onerror=, onload=, or javascript: substrings
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after loading file listings
Anomalous session token reuse from geographically distinct IP addresses following administrator activity in ContiNew Admin

Detection Strategies

Inspect web server and reverse proxy access logs for POST or PUT requests to /dev-api/common/file containing suspicious characters in the File argument
Deploy Content Security Policy (CSP) reporting to capture inline script violations originating from the ContiNew Admin origin
Run periodic queries against the file metadata store to identify records containing HTML or JavaScript syntax

Monitoring Recommendations

Enable verbose logging on the ContiNew Admin API gateway and forward events to a centralized SIEM for correlation
Alert on administrator sessions that spawn outbound network requests to previously unseen domains
Monitor for privilege escalation events or new administrative accounts created shortly after suspicious file-related API activity

How to Mitigate CVE-2025-4551

Immediate Actions Required

Restrict access to the ContiNew Admin interface to trusted networks or VPN-only reachability until a patch is available
Audit stored file records for existing malicious payloads and purge any entries containing script content
Rotate administrative session tokens and credentials that may have been exposed to the vulnerable endpoint
Enforce a strict Content Security Policy that disallows inline scripts on the admin interface

Patch Information

At the time of publication, no vendor patch is listed in the NVD entry or referenced advisories. The vendor was contacted before public disclosure but did not respond. Organizations running ContiNew Admin 3.6.0 or earlier should monitor the ContiNew Admin project references and the VulDB entry #308298 for updates.

Workarounds

Place a Web Application Firewall (WAF) rule in front of /dev-api/common/file that rejects requests containing HTML tags or JavaScript syntax in the File argument
Apply server-side output encoding at any location that renders file metadata within the administrative UI
Disable or limit the file upload feature for non-essential user roles until a vendor fix is released
Require multi-factor authentication for all administrative accounts to reduce the impact of session hijacking

bash

# Example ModSecurity rule blocking script content in the File parameter
SecRule ARGS:File "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1004551,phase:2,deny,status:403,\
    msg:'CVE-2025-4551 ContiNew Admin XSS attempt blocked',\
    tag:'CWE-79',tag:'CVE-2025-4551'"