CVE-2025-5523: Enilu Web-flash XSS Vulnerability

CVE-2025-5523 Overview

CVE-2025-5523 is a cross-site scripting (XSS) vulnerability in enilu web-flash 1.0. The flaw resides in the fileService.upload function within src/main/java/cn/enilu/flash/api/controller/FileController/upload. An authenticated remote attacker can manipulate the File argument during upload to inject script payloads that execute in the browser context of other users. The exploit has been disclosed publicly, increasing the likelihood of opportunistic abuse against exposed deployments. The weakness is tracked under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact

Successful exploitation enables session hijacking, credential theft, and unauthorized actions against users who view attacker-controlled file uploads.

Affected Products

• enilu web-flash 1.0
• Component: File Upload (FileController.upload)
• Function: fileService.upload

Discovery Timeline

• 2025-06-03 - CVE-2025-5523 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5523

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the file upload workflow of enilu web-flash. The fileService.upload handler accepts a File parameter without properly neutralizing script-bearing content or metadata. When the uploaded content is later rendered in the application interface, embedded JavaScript executes within the browser context of any user viewing the resource.

Because the attack targets client-side execution, its impact extends to session cookies, tokens stored in the DOM, and any action the victim is authorized to perform. The attack requires low privileges and user interaction, but network reachability is sufficient to reach the vulnerable endpoint.

Root Cause

The root cause is missing input validation and output encoding on the file upload endpoint. User-supplied data associated with the File argument is stored and later reflected in HTTP responses without contextual escaping. The application does not enforce content-type restrictions or sanitize filenames and metadata against script payloads.

Attack Vector

An attacker with a low-privileged account uploads a file whose name or content contains a JavaScript payload. When another user, including administrators, accesses the file listing or preview interface, the payload executes in their session. Exploitation requires only a browser and network access to the web-flash application. Public technical discussion is available at the Gitee issue ICAXTM and VulDB entry #310959.

No verified proof-of-concept code has been published to trusted repositories. The vulnerability mechanism is described in prose because verified exploit code is not available.

Detection Methods for CVE-2025-5523

Indicators of Compromise

• Uploaded files with names or metadata containing HTML tags such as <script>, <img onerror=, or <svg onload=.
• HTTP POST requests to the FileController.upload endpoint carrying unusual Content-Disposition filenames.
• Outbound browser requests from authenticated user sessions to attacker-controlled domains shortly after viewing file listings.
• Unexpected JavaScript execution errors in browser consoles when accessing the file management interface.

Detection Strategies

• Inspect web server access logs for multipart/form-data uploads to the upload route with suspicious filename patterns.
• Deploy web application firewall rules to flag script tags and event handlers in filename and metadata fields.
• Monitor stored file records for embedded HTML or JavaScript content in fields that should contain plain identifiers.
• Correlate file upload events with subsequent anomalous session activity from privileged accounts.

Monitoring Recommendations

• Enable verbose logging on the file upload controller and forward events to a centralized log platform.
• Alert on repeated upload attempts from the same low-privileged user within short intervals.
• Track browser Content Security Policy (CSP) violation reports to identify blocked payload execution attempts.

How to Mitigate CVE-2025-5523

Immediate Actions Required

• Restrict access to the file upload endpoint to trusted users pending a vendor fix.
• Apply a strict Content Security Policy that disables inline script execution across the application.
• Audit existing uploaded files for embedded HTML or JavaScript payloads and quarantine suspicious entries.
• Rotate session tokens for administrative accounts if any suspicious upload activity is identified.

Patch Information

At the time of publication, no official vendor patch is referenced in the NVD entry. Track the upstream project through the Gitee issue tracker and the VulDB advisory for updates. Until a fix is released, apply the workarounds described below.

Workarounds

• Place the application behind a reverse proxy or web application firewall configured to reject uploads with script-bearing filenames and content.
• Enforce server-side filename normalization that strips HTML special characters before storage.
• Serve uploaded files from an isolated origin using Content-Disposition: attachment and a restrictive X-Content-Type-Options: nosniff header.
• Disable file upload functionality entirely if it is not required for business operations.

# Example nginx hardening for the file upload path
location /api/file/upload {
    client_max_body_size 5m;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Security-Policy "default-src 'none'; script-src 'none'; frame-ancestors 'none'" always;
}

location /files/ {
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options "nosniff" always;
}