CVE-2025-71385: Netdata XSS Vulnerability in ilove SVG Endpoints (Medium, CVSS 6.1)

Technical summary

CVE-2025-71385 is a DOM-based reflected XSS vulnerability affecting the `api/v2/ilove.svg` and `api/v3/ilove.svg` endpoints in Netdata. The vulnerability stems from insufficient input validation: the `love` query parameter is reflected verbatim into a text element within an SVG document served with `Content-Type: image/svg+xml`, without HTML or XML entity encoding. This allows injection of arbitrary XML/SVG tags and JavaScript. The endpoints are registered with `HTTP_ACL_NOCHECK` permitting anonymous access; bearer-token authentication is disabled by default, making them reachable on standard Netdata agent installations. Netdata 2.3.1 resolves the issue by removing the vulnerable endpoints entirely.

Business impact

This vulnerability poses a moderate but real risk to organizations running Netdata monitoring agents. If an attacker tricks a user (such as a system administrator or security operator) into clicking a malicious link to a Netdata instance they monitor, the attacker can steal session cookies, authentication tokens, or sensitive dashboard data accessible from that origin. In multi-tenant or shared monitoring environments, XSS on the monitoring interface can undermine trust in dashboard integrity and enable lateral movement or privilege escalation if Netdata holds credentials for downstream systems. The attack requires user interaction (clicking a link), which limits but does not eliminate the practical impact.

Affected systems

Netdata versions before 2.3.1 are affected. The vulnerable endpoints are present in any standard Netdata agent installation with default settings. Organizations should verify their Netdata version via the web UI (typically accessible on port 19999) or by checking agent logs and package metadata. Notably, the vulnerability does not require special Netdata configuration to be exploitable—the endpoints are enabled by default and anonymous-accessible.

Exploitability

Exploitation requires network access to a Netdata instance and social engineering or credential phishing to deliver a malicious URL to a user with a legitimate reason to access that Netdata dashboard. No authentication bypass is necessary. An attacker cannot exploit this vulnerability passively; the victim must navigate to the crafted URL. However, the low bar for crafting the attack (a simple URL with script tags) and the default-accessible nature of the endpoints mean this is relatively straightforward for a moderately skilled attacker. No exploit code in the wild has been confirmed at publication, and the vulnerability was not added to the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade Netdata to version 2.3.1 or later. The fix removes the vulnerable endpoints entirely, eliminating the attack surface. For organizations unable to patch immediately, consider restricting network access to the Netdata web UI (port 19999) to trusted internal subnets only, or place Netdata behind an authentication proxy. Disabling anonymous access via Netdata's access control list (ACL) configuration may also reduce exposure, though this does not address the root cause.

Patch guidance

Apply Netdata 2.3.1 or later through your standard package management tools (apt, yum, Docker, etc.). Verify successful upgrade by checking the version string in the Netdata web UI (Administration → About) or via command line. No special configuration changes are required post-upgrade; the endpoints will be absent and requests to them will return 404. Test the upgrade in a non-production environment first if feasible. Netdata provides both stable and nightly releases; confirm your deployment strategy aligns with your organization's release cadence.

Detection guidance

Monitor web server or reverse-proxy logs for requests to `/api/v2/ilove.svg` or `/api/v3/ilove.svg` with query parameters containing script tags, HTML entities, or suspicious payloads. Look for `Content-Type: image/svg+xml` responses from Netdata that may indicate the vulnerable endpoint was accessed. If running a WAF, create a rule to detect or block requests to these endpoints or to any SVG endpoint accepting parameters with script-like content. Endpoint detection and response (EDR) tools may flag JavaScript execution from unexpected browser origins if exploitation occurs.

Why prioritize this

This vulnerability merits timely remediation but is not critical. The CVSS score of 6.1 (Medium) reflects the need for user interaction and the limited direct impact (confidentiality and integrity, no availability impact). However, the default-accessible nature of the endpoints, the simplicity of the attack, and the relevance to organizations that rely on Netdata for security monitoring make it a practical concern. Prioritize patching Netdata instances in security-sensitive environments or those exposed to the internet; internal-only instances face lower risk but should still be updated in standard maintenance windows.

Risk score, explained

CVSS 3.1 score of 6.1 reflects: Attack Vector Network (AV:N)—unauthenticated, remote exploitability; Attack Complexity Low (AC:L)—no special conditions required; Privileges Required None (PR:N)—no authentication needed; User Interaction Required (UI:R)—victim must click a link; Scope Changed (S:C)—impact can cross origin boundaries; Confidentiality Low (C:L)—session data or dashboard info could be exfiltrated; Integrity Low (I:L)—attacker can modify page content as displayed; Availability None (A:N)—no denial of service impact. The Medium severity appropriately balances the ease of exploitation against the requirement for user interaction.

Frequently asked questions