New Vulnerability module for CVE_2025_54589

[Aarush289]

Proposed change

This PR adds a new vulnerability detection module for CVE-2025-54589, affecting Copyparty.

The vulnerability is a reflected Cross-Site Scripting (XSS) issue caused by improper sanitization of user-controlled input in HTTP query parameters. An unauthenticated attacker can inject arbitrary JavaScript code which is reflected in the server response and executed in the victim’s browser.

The module sends a crafted HTTP GET request containing an XSS payload and determines vulnerability by identifying reflection of the injected payload in the HTML response.

The module has been tested in a local environment against a vulnerable Copyparty instance to verify correct detection behavior.

---

Type of change

• New module / payload addition

---

Checklist

• I’ve followed the contributing guidelines
• I’ve run make pre-commit and it didn’t generate any changes
• I’ve run make test and all tests passed locally

---

Additional notes

• References to NVD and the official Copyparty security advisory are included for verification
• The module follows existing OWASP Nettacker conventions for module naming, severity, and detection logic
• The issue is classified as medium severity, consistent with the assigned CVSS score
• The module was validated locally by running Copyparty on a test instance and confirming payload reflection

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2bc2d8ae-2188-4605-b367-07c80b569f45

📥 Commits

Reviewing files that changed from the base of the PR and between ba72d04 and c555aee.

📒 Files selected for processing (1)

• nettacker/modules/vuln/copyparty_xss_cve_2025_54589.yaml

---

Summary by CodeRabbit

• Documentation
  • Added a new entry for the Copyparty CVE-2025-54589 vulnerability to the modules documentation, including a brief description and detection overview.
• New Features
  • Introduced a new automated vulnerability detection module for Copyparty CVE-2025-54589 to check for reflected XSS behavior using HTTP requests with response-content matching (via the filter parameter).

Walkthrough

Added a Copyparty CVE-2025-54589 vulnerability module with reflected XSS detection and documented it in the module list.

Changes

Copyparty XSS module

Layer / File(s)	Summary
Add vulnerability detection and documentation nettacker/modules/vuln/copyparty_xss_cve_2025_54589.yaml, docs/Modules.md	Adds Copyparty XSS detection metadata, an HTTP payload using the filter parameter, response matching, port 3923 support, and the corresponding module-list entry.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: new module

Suggested reviewers: arkid15r

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: adding a new vulnerability module for CVE-2025-54589.
Description check	✅ Passed	The description is directly related to the changeset and accurately describes the new Copyparty XSS detection module.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Aarush289]

screenshots of test are :

[securestep9]

@codex review this PR using skill: https://github.com/nettacker-codex-ai/skills/blob/main/pr-review-recommender/SKILL.md

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ba72d0421d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Require an HTML response before reporting XSS

When a non-Copyparty endpoint returns 200 and reflects query parameters in a non-executable response such as text/plain or JSON, this content-only condition reports CVE-2025-54589 even though no browser XSS is possible. Add a Content-Type: text/html condition (and ideally a Copyparty-specific fingerprint) before treating the reflected bytes as this vulnerability.

Useful? React with 👍 / 👎.

[Aarush289]

Practically redundant, the regex is unique good enough to detect only the required cve

[chatgpt-codex-connector]

Include Copyparty's default port

On a standard Copyparty deployment listening on its default port 3923, a scan with default settings never sends this probe: these candidates contain only 80 and 443, while the repository's default port_scan list also omits 3923, so service discovery cannot find the service and may drop the HTTP payload entirely. Users must know to pass -g 3923; include 3923 in the module and default discovery coverage.

Useful? React with 👍 / 👎.