Description

The official VaahCMS packages (versions 2.0.0 through 2.3.4, distributed via the vendor's releases) contain an obfuscated, malicious JavaScript payload embedded in the Blade template used for security / OTP emails.

Because the payload ships inside legitimate releases, any deployment that installs an affected version silently serves attacker-controlled client-side code to its users — a supply-chain compromise rather than a bug triggered by external input.

Malicious behavior

Once rendered in a victim's browser, the deobfuscated payload:

• Establishes a WebSocket connection to a command-and-control (C2) server, giving the operator a live channel into the page.
• Deploys keystroke logging on password fields by watching the DOM with a MutationObserver and hooking newly inserted inputs.
• Extracts WhatsApp Web session data from the victim's browser context.
• Accepts remote commands to manipulate the rendered page (inject content, redirect, alter the DOM on demand).

Affected component

• Location: Blade template for security OTP emails
• Root cause: malicious obfuscated JavaScript committed into the official source / release artifacts (embedded backdoor)

Proof of Concept

⚠️ Defensive / analysis use only. This advisory is published after the issue was fixed and publicly disclosed. Do not deploy the payload or point it at any C2 infrastructure.

Identifying the payload (safe reproduction)

1. Obtain an affected release (VaahCMS 2.0.0–2.3.4) in an isolated VM.
2. Locate the OTP / security email Blade template.
3. Observe the obfuscated <script> block that does not belong to the legitimate template logic.
4. Statically deobfuscate the payload (no execution) to reveal the WebSocket C2 setup, the MutationObserver keylogger, and the WhatsApp Web exfiltration logic.
5. In a sandboxed browser with network monitoring, confirm the outbound WebSocket beacon to the hardcoded C2 endpoint.

See poc/ for a static-analysis / detection helper (no live payload).

Impact

An attacker controlling the C2 endpoint can, for every user who renders the affected template:

• Steal credentials typed into password fields (keylogging).
• Hijack authenticated sessions (incl. WhatsApp Web data).
• Remotely manipulate page content and behavior in real time.

Remediation

• Upgrade to a fixed VaahCMS release (post-2.3.4) that removes the payload.
• Audit existing installs for the malicious <script> in the OTP email template.
• Review outbound WebSocket connections from mail-rendering / admin contexts.
• Rotate any credentials that may have been exposed while an affected version was live.

Disclosure timeline

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-67595
• Positive Technologies advisory (PT-2026-65916): https://dbugs.ptsecurity.com/researchers/Ilhomjon%20Rustamov
• Vendor: VaahCMS — https://vaah.dev

Credit

Discovered and reported by Ilhomjon Rustamov · HackTheBox · [email protected]

Disclaimer

Published for educational and defensive purposes only, after the vulnerability was fixed and publicly disclosed. Do not use this material against systems you are not authorized to test.