CVE-2025-64339
📋 TL;DR
ClipBucket v5 has a stored XSS vulnerability in the Manage Playlists feature where authenticated low-privileged users can inject malicious JavaScript into playlist names. This code executes in the browsers of anyone viewing the playlist pages, including administrators. The vulnerability affects versions 5.5.2-#146 and below.
💻 Affected Systems
- ClipBucket v5
📦 What is this software?
Clipbucket by Oxygenz
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform account takeover, deface the website, or redirect users to malicious sites.
Likely Case
Attackers will steal user session cookies and credentials, potentially compromising multiple user accounts.
If Mitigated
With proper input validation and output encoding, the malicious code would be rendered harmless as text.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple - just creating a playlist with malicious name.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.5.2-#147
Vendor Advisory: https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-c695-m4g4-v3fv
Restart Required: No
Instructions:
1. Backup your current installation
2. Download version 5.5.2-#147 or newer from GitHub
3. Replace affected files with patched versions
4. Clear any cached data
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side input validation to sanitize playlist names before storage
Modify playlist creation/update functions to escape HTML special characters
Output Encoding
allImplement proper output encoding in playlist display templates
Ensure all playlist name outputs use HTML entity encoding
🧯 If You Can't Patch
- Disable playlist creation for low-privileged users
- Implement WAF rules to block XSS payloads in playlist names
🔍 How to Verify
Check if Vulnerable:
Check if your ClipBucket version is 5.5.2-#146 or earlierCheck Version:
Check the version.php file or admin panel for version informationVerify Fix Applied:
Test creating a playlist with basic XSS payload like <script>alert('test')</script> and verify it's properly escaped📡 Detection & Monitoring
Log Indicators:
- Unusual playlist creation patterns
- Playlist names containing script tags or JavaScript code
Network Indicators:
- HTTP requests with suspicious parameters in playlist creation
SIEM Query:
source="web_logs" AND (playlist_name CONTAINS "<script>" OR playlist_name CONTAINS "javascript:")