CVE-2025-32961

Executive Summary

CVE-2025-32961 is a stored Cross-Site Scripting (XSS) vulnerability in the Cuba JPA web API component of the Jmix framework. The vulnerability allows an attacker to manipulate the Content-Type header of a response to text/html by controlling the file name extension in an input parameter. If a malicious file (e.g., containing JavaScript) is uploaded beforehand, the browser will execute the script when the crafted request is made. The CVSS score is 6.4 (Medium), and the vulnerability affects versions prior to 1.1.1. No public exploit code or Nuclei template is available at this time.

Supply Chain & Package Security

This vulnerability affects the Jmix framework, which is a Java-based open-source platform. The Cuba JPA web API is a component that handles entity persistence via HTTP. Since Jmix is distributed as a Java library (JAR), the supply chain risk is moderate. Organizations using Jmix should verify they are using version 1.1.1 or later, and apply the workaround if immediate patching is not possible.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must visit a crafted URL
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. The vulnerability requires user interaction and prior upload of a malicious file, but the attack surface is broad due to the network-based vector.

Deep Dive & Mechanics

The Cuba JPA web API allows loading and saving entities via HTTP requests. The vulnerability lies in how the API handles the Content-Type header of the response. When a request includes a file path parameter, the API uses the file extension to determine the Content-Type. If the file name ends with .html, the API sets Content-Type: text/html. An attacker can exploit this by:

1. Uploading a malicious file (e.g., malicious.html) containing JavaScript code.
2. Crafting a request that references this file path, causing the API to return the file content with Content-Type: text/html.
3. The victim’s browser executes the JavaScript, leading to XSS.

The root cause is insufficient validation of the file extension in the input parameter. The API should not allow arbitrary file extensions to influence the Content-Type header.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.1.1):

// Pseudo-code showing the vulnerable logic
public Response getEntity(String filePath) {
    String contentType = determineContentType(filePath); // Uses file extension
    return Response.ok(entityData).type(contentType).build();
}

private String determineContentType(String filePath) {
    if (filePath.endsWith(".html")) {
        return "text/html";
    }
    return "application/octet-stream";
}

Patched Code (1.1.1):

// Pseudo-code showing the fix
public Response getEntity(String filePath) {
    // Sanitize file path and enforce safe content type
    String safeContentType = "application/octet-stream";
    return Response.ok(entityData).type(safeContentType).build();
}

The patch removes the logic that sets Content-Type based on the file extension, defaulting to a safe binary type.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to upload a file to the Jmix application.
• Ability to craft HTTP requests.

Steps:

1. Upload a malicious HTML file containing JavaScript (e.g., malicious.html):

   <script>alert('XSS');</script>
   

2. Craft a GET request to the Cuba JPA API endpoint with the file path parameter:

   GET /api/entities/load?filePath=uploads/malicious.html HTTP/1.1
   Host: target.com
   

3. The server responds with Content-Type: text/html and the malicious content.
4. Victim visits the crafted URL, and the script executes.

No exploit code is publicly available.

Blue Team (Detection & Defense)

Detection:

• Monitor for HTTP requests with file paths ending in .html to the Cuba JPA API.
• Look for unusual Content-Type headers in API responses (e.g., text/html for non-HTML endpoints).

Defense:

• Apply the patch (upgrade to version 1.1.1).
• Implement input validation to reject file paths with .html extension.
• Use a Web Application Firewall (WAF) to block requests with suspicious file extensions.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/entities/load with filePath parameter ending in .html.
  • HTTP responses with Content-Type: text/html from the Cuba JPA API.
• File IOCs:
  • Uploaded files with .html extension in the application’s upload directory.
• Log IOCs:
  • Server logs showing GET /api/entities/load?filePath=...html requests.

Detection Engineering

YARA Rule

rule CVE_2025_32961_Jmix_XSS {
    meta:
        description = "Detects malicious HTML files uploaded for CVE-2025-32961 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32961"
    strings:
        $html_tag = /<script[^>]*>.*<\/script>/i
        $file_ext = ".html"
    condition:
        $html_tag and $file_ext at 0
}

Sigma Rule

title: CVE-2025-32961 - Jmix Cuba JPA API XSS Attempt
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to Jmix Cuba JPA API with .html file extension
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/api/entities/load'
        cs-uri-query|endswith: '.html'
    condition: selection
falsepositives:
    - Legitimate use of .html files in API (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-32961 - Jmix Cuba JPA API XSS Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/api/entities/load"; http_uri;
    content:".html"; http_uri;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Jmix to version 1.1.1 or later.
2. If upgrade is not possible, apply the workaround from the Jmix documentation (likely involves disabling the vulnerable API endpoint or adding input validation).

Long-term Measures:

• Implement strict input validation for all file path parameters.
• Use a Content Security Policy (CSP) header to mitigate XSS impact.
• Conduct regular security audits of API endpoints.

Valters IT Signature: This report was generated by Valters IT – DevSecOps & Cyber Threat Intelligence Division.