CVE-2025-57769: 
NixOS vulnerability analysis and mitigation

CVE-2025-57769 is a clickjacking vulnerability in FreshRSS, a free self-hostable RSS aggregator, that can lead to Cross-Site Scripting (XSS) or privilege escalation. Affecting versions 1.26.3 and below, the flaw allows a specially crafted page to trick authenticated users into executing arbitrary JavaScript or promoting a user's privileges by obscuring UI elements within iframes. The vulnerability was disclosed on September 27, 2025, and patched in version 1.27.0 released August 18, 2025. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Red Hat CVE).

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting) and CWE-1021 (Improper Restriction of Rendered UI Layers or Frames). FreshRSS did not implement a Content-Security-Policy: frame-ancestors header, allowing an attacker-controlled page to embed authenticated FreshRSS iframes and overlay or obscure UI elements. Two attack chains are possible: (1) an XSS attack where the user is socially engineered to drag a malicious payload (disguised as an image) into the UserJS textarea and then click Submit, executing arbitrary JavaScript; and (2) a privilege escalation attack where the admin's "Promote user" button is obscured and the victim is tricked into clicking it, bypassing the JavaScript confirmation dialog by embedding the iframe with sandbox="allow-forms" (disabling scripts and thus the confirm() modal). Both attack paths require user interaction and are confirmed to work on Firefox (GitHub Advisory, Patch PR).

Successful exploitation can result in arbitrary JavaScript execution within the victim's authenticated FreshRSS session, exposing session tokens (e.g., CSRF tokens) and account details, or in unauthorized privilege escalation where a regular user is promoted to administrator. The XSS vector allows an attacker to exfiltrate sensitive session data and perform actions on behalf of the victim, while the privilege escalation vector could grant an attacker administrative control over the FreshRSS instance. Availability is not directly impacted, but confidentiality and integrity are both at risk (GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub security advisory, demonstrating both the XSS and privilege escalation attack chains. The EPSS score is approximately 0.043%, indicating low probability of widespread automated exploitation. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (the victim must be logged into FreshRSS and interact with the attacker's crafted page), and the PoC is confirmed to work only on Firefox (GitHub Advisory).

1. Reconnaissance: Identify a target running FreshRSS version 1.26.3 or earlier that is accessible and allows iframe embedding (no frame-ancestors CSP header present).
2. Craft malicious page (XSS path): Host an HTML page on an attacker-controlled server that embeds two FreshRSS iframes — one for the extension settings page (to enable UserJS) and one overlaying the UserJS textarea. Disguise the XSS payload (e.g., ;window.onload = () => alert(context.csrf)//) as a draggable image element.
3. Social engineering (XSS): Trick the authenticated FreshRSS user into visiting the attacker's page, enabling UserJS via the obscured iframe, dragging the "rabbit" image (actually the XSS payload) into the displayed "box" (actually the UserJS textarea), and clicking the visible "Submit" button.
4. Payload execution: Upon submission, FreshRSS saves and executes the injected JavaScript, allowing the attacker to steal CSRF tokens, session data, or perform further actions.
5. Craft malicious page (privilege escalation path): Host an HTML page embedding the FreshRSS admin user management page in an iframe with sandbox="allow-forms allow-same-origin" (disabling scripts, thus bypassing the confirm() dialog). Overlay the "Promote" button with a decoy UI element.
6. Social engineering (privilege escalation): Trick an admin user into clicking the decoy button, which actually clicks the hidden "Promote" button, escalating a target user's privileges without triggering the JavaScript confirmation dialog (GitHub Advisory).

• Network: HTTP requests from a FreshRSS server to unexpected external origins; referrer headers in FreshRSS access logs pointing to unknown external domains when accessing extension settings or admin user management pages.
• Logs: FreshRSS access logs showing POST requests to the UserJS/extension settings endpoint originating from unusual referrers; admin logs showing unexpected user promotion events.
• Application: Unexpected or obfuscated content in the UserJS textarea of the FreshRSS extension settings; unexpected changes in user privilege levels (e.g., a regular user suddenly having admin rights).
• Browser: Users on Firefox reporting unexpected prompts, alerts, or behavior after visiting external pages while logged into FreshRSS (GitHub Advisory).

The vulnerability is fixed in FreshRSS version 1.27.0 (released August 18, 2025), which adds a Content-Security-Policy: frame-ancestors 'none' header to all pages except the content preview action (which uses frame-ancestors 'self'). Administrators should upgrade to version 1.27.0 immediately. As a temporary workaround prior to upgrading, server administrators can manually add the Content-Security-Policy: frame-ancestors 'none' HTTP response header at the web server level (e.g., via Apache or Nginx configuration) to prevent FreshRSS pages from being embedded in iframes (Patch PR, Release Notes).

The vulnerability was reported by researcher "Inverle" and acknowledged by the FreshRSS maintainer "Alkarex," who merged the fix (PR #7677) on June 18, 2025, ahead of the 1.27.0 release. The fix was part of a broader security hardening effort in version 1.27.0, which included multiple additional security improvements such as reauthentication (sudo mode), improved CSP coverage, and access control fixes. No significant broader media coverage or notable external researcher commentary has been identified beyond the GitHub advisory (GitHub Advisory, Release Notes).