CVE-2025-63848
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in SWI-Prolog allows attackers to inject malicious scripts into web IDE notebooks. When users view these notebooks, the scripts execute in their browsers, potentially compromising their sessions or systems. Anyone using SWI-Prolog web IDE through version 2.2.0 is affected.
💻 Affected Systems
- SWI-Prolog
📦 What is this software?
Swish by Swi Prolog
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on user systems.
Likely Case
Session hijacking, credential theft, or defacement of web IDE content through script execution in victim browsers.
If Mitigated
Limited impact with proper content security policies, input validation, and output encoding in place.
🎯 Exploit Status
Exploitation requires ability to create or modify web IDE notebooks; public proof-of-concept available in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not yet released
Vendor Advisory: https://github.com/SWI-Prolog
Restart Required: Yes
Instructions:
1. Monitor SWI-Prolog GitHub for security updates. 2. Upgrade to patched version when available. 3. Restart SWI-Prolog services after update.
🔧 Temporary Workarounds
Disable Web IDE
allTemporarily disable SWI-Prolog web IDE functionality until patch is available.
Configure SWI-Prolog to not start web server or disable web IDE module
Implement Content Security Policy
allAdd strict CSP headers to prevent script execution from untrusted sources.
Add 'Content-Security-Policy: default-src 'self'; script-src 'self'' to web server headers
🧯 If You Can't Patch
- Restrict access to SWI-Prolog web IDE to trusted users only
- Implement web application firewall rules to block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check if SWI-Prolog version is 2.2.0 or earlier and web IDE is enabled.Check Version:
swipl --versionVerify Fix Applied:
After update, verify version is above 2.2.0 and test XSS payloads no longer execute.📡 Detection & Monitoring
Log Indicators:
- Unusual notebook creation/modification patterns
- Suspicious script tags in notebook content
Network Indicators:
- Malicious script payloads in HTTP POST/PUT requests to notebook endpoints
SIEM Query:
source="swi-prolog" AND (http_method="POST" OR http_method="PUT") AND (uri="*notebook*" OR uri="*ide*") AND (content="<script>" OR content="javascript:")