CVE-2025-67634

Executive Summary

CVE-2025-67634 is a cross-site scripting (CWE-79) vulnerability in the CISA Software Acquisition Guide Supplier Response Web Tool affecting versions prior to 2025-12-11. An attacker who convinces a user to import a specially-crafted JSON file can cause the Tool to load and execute attacker-supplied JavaScript in the user's browser context when the user submits the page by clicking "Next". Impact is rated Moderate (CVSS 3.1 base 4.4), reflecting limited confidentiality and integrity impact, local attack vector, and the requirement for user interaction.

Technical Analysis

The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly "Cross-Site Scripting"). Per the NVD description, the affected component is the CISA Software Acquisition Guide Supplier Response Web Tool, and the vulnerable input path is a JSON file import feature. The Tool does not properly sanitize or encode content drawn from imported text fields before rendering it into the page; when the file contains JavaScript, that script is loaded into the page and executes in the context of the user's browser session once the user submits the form by clicking "Next".

The attack vector is best characterized as DOM-based / client-side XSS performed through a file-import workflow rather than a server-reflected or stored XSS delivered over the network. The NVD description does not identify specific functions, endpoints, parameters, or JSON field names involved, and no further code-level detail is available in the supplied data. Analysis is therefore constrained to the vulnerability class and the described execution mechanism.

CVSS 3.1 vector analysis (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N):

• AV:L (Local) — the attacker cannot exploit the target remotely in a single network request; the attack requires delivery of a file that the victim imports into the application. This status is consistent with the requirement that the victim take a local file-handling action.
• AC:L (Low) — no special conditions or race windows are needed once the crafted file reaches the user.
• PR:N (No Privileges Required) — the importing user does not need elevated privileges in the Tool for the script to execute.
• UI:R (User Interaction Required) — the victim must both import the crafted JSON file and click "Next" to submit the page, which triggers execution.
• S:U (Unchanged Scope) — execution is confined to the user's browser context and does not cross a security boundary such as the server or another origin.
• C:L / I:L (Low Confidentiality/Integrity) — the executing JavaScript operates in the user's authenticated context within the Tool, which can expose limited data or permit limited modification of the rendered session; full account takeover or system compromise is not established by the vector.
• A:N (No Availability Impact) — no denial-of-service component is described.

The "before 2025-12-11" version boundary indicates the vendor addressed the flaw through a code change on or prior to that date; the exact fix version string is not provided, so the only reliable affected-version boundary is date-based.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The following chain is inferred strictly from the vulnerability class and the NVD description. No specific function names, endpoints, or JSON field identifiers are asserted, because none appear in the source data.

1. Reconnaissance / target identification: The attacker identifies an organization that uses the CISA Software Acquisition Guide Supplier Response Web Tool, or a supplier/contractor that is expected to submit responses through it. Because the attack requires the victim to import a file and interact with the Tool, targeting is typically directed at a specific individual who regularly processes supplier responses rather than mass scanning.

2. Crafting the malicious file: The attacker builds a JSON file that satisfies the Tool's expected import structure so it will be accepted, while placing a JavaScript payload inside one or more text fields that the Tool renders back to the page. At the vulnerability-class level, the payload relies on the Tool inserting imported text into the DOM without proper output encoding, so the payload is interpreted as markup/script rather than as inert data.

3. Delivery and trigger: The attacker delivers the JSON file to the victim through a channel appropriate to the engagement — for example, a supplier responds to a solicitation with an attached or linked file, or the file is supplied as part of a business communications exchange. The victim imports the file into the Tool. No script execution occurs at import time as described; execution occurs when the victim submits the page by clicking "Next", at which point the Tool loads the JavaScript from the file into the page and the browser executes it in the user's context.

4. Post-exploitation impact: Because the script runs in the user's browser context for the Tool, it can act with the user's session privileges: read and exfiltrate content visible to the user, manipulate the page as displayed to the user, or initiate actions the user's session is authorized to perform. The CVSS subscores cap this at Low confidentiality and Low integrity impact; there is no described availability impact and no scope change to the server.

Impact Assessment

Business impact is Moderate and centered on integrity and confidentiality of the user's in-session data within the Supplier Response Web Tool. The affected population is narrow: organizations and personnel who use the CISA Software Acquisition Guide Supplier Response Web Tool, particularly supplier-side responders and government-side evaluators who import supplier response files. The blast radius is limited per successful attack to a single victim's browser session, since the vector requires local file import plus a submit action (UI:R) and scope is unchanged (S:U).

CVSS 3.1 base score is 4.4 with C:L/I:L/A:N, indicating partial loss of confidentiality and integrity and no availability impact. EPSS is 0.00190 (8.0th percentile of exploited CVEs), which suggests low near-term exploit probability based on available evidence; combined with the absence of a public PoC, exploit code, or Nuclei template, there is no observed evidence of active exploitation. The CVE is not listed in CISA KEV. The most likely real-world misuse is targeted social engineering (supplier-themed lures that deliver a crafted JSON file) rather than opportunistic, internet-wide exploitation.

Secondary considerations: because the executing script operates in the user's authenticated context, a successful attack could be used to alter or misrepresent response data presented to the victim, or to exfiltrate data the victim can see. Trust in acquisition data integrity is the relevant business risk for this Tool's use case.

Detection Guidance

Sigma Rule

title: Suspicious JavaScript Content in Imported JSON Files (CVE-2025-67634)
id: 3f6a9c2e-5b41-4d7a-9e88-1c0d2b7a4e10
status: experimental
description: Detects JSON files written to disk that contain script-bearing content typical of an imported supplier-response file abused for client-side XSS (CVE-2025-67634).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-67634
author: valtersit.com Threat Intelligence
date: 2025/12/11
logsource:
  category: file_event
  product: windows
detection:
  selection_ext:
    TargetFilename|endswith: '.json'
  selection_content_marker:
    - TargetFilename|contains: 'Supplier'
    - TargetFilename|contains: 'Response'
    - TargetFilename|contains: 'Acquisition'
    - TargetFilename|contains: 'SAG'
  filter_benign:
    TargetFilename|contains:
      - '\\AppData\\Local\\Temp\\chrome_'
      - '\\node_modules\\'
  condition: selection_ext and selection_content_marker and not filter_benign
fields:
  - TargetFilename
  - Image
  - User
falsepositives:
  - Legitimate supplier response JSON files whose filenames contain these tokens
level: low
tags:
  - attack.t1204.002
  - cve.2025.67634

YARA Rule

rule CVE_2025_67634_JSON_Import_XSS
{
    meta:
        description = "Detects JSON files containing HTML/script-bearing content consistent with client-side XSS via JSON import (CVE-2025-67634)"
        author = "valtersit.com Threat Intelligence"
        date = "2025-12-11"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-67634"
        cve = "CVE-2025-67634"

    strings:
        $json_open  = "{" ascii
        $script_tag = "<script" ascii nocase
        $script_tag2 = "</script>" ascii nocase
        $js_proto   = "javascript:" ascii nocase
        $onerror    = "onerror=" ascii nocase
        $onload     = "onload=" ascii nocase
        $img_tag    = "<img" ascii nocase
        $svg_tag    = "<svg" ascii nocase
        $iframe_tag = "<iframe" ascii nocase

    condition:
        filesize < 2MB and
        $json_open at 0 and
        2 of ($script_tag, $script_tag2, $js_proto, $onerror, $onload, $img_tag, $svg_tag, $iframe_tag)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-67634 Possible XSS Payload in Imported Supplier Response JSON"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Content-Type|3a 20|application/json"; http.request_body; content:"<script"; nocase; http.request_body; content:"</script>"; nocase; reference:cve,2025-67634; reference:url,nvd.nist.gov/vuln/detail/CVE-2025-67634; classtype:web-application-attack; sid:202567634; rev:1;)

Note: because the vulnerable content path is a client-side import-and-render flow, network visibility may be limited. The rule above triggers only in deployments where the crafted JSON traverses the wire to the application.

Elastic Detection

file where event.action == "creation" and
  file.extension == "json" and
  file.name : ("*Supplier*", "*Response*", "*Acquisition*", "*SAG*")

Splunk SPL Query

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval fn=lower(TargetFilename)
| where like(fn, "%.json")
| where match(fn, "(supplier|response|acquisition|sag)")
| stats count values(TargetFilename) as files by ComputerName, User
| where count > 0

Wazuh OSSEC Rule

<group name="cve_2025_67634,web,">
  <rule id="100634" level="5">
    <if_sid>550</if_sid>
    <field name="file">\.json$</field>
    <match>Supplier|Response|Acquisition|SAG</match>
    <description>CVE-2025-67634: Possible imported supplier response JSON file (potential client-side XSS vector)</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The only known patch reference is the CNA designation that versions "before 2025-12-11" are affected, implying a fix on or after that date. No vendor advisory URL, changelog, or specific version string is provided; organizations should verify the fix independently.

1. Immediate mitigations:

• Restrict use of the Software Acquisition Guide Supplier Response Web Tool to trusted files and trusted senders. Treat unsolicited or unexpected supplier-response JSON files as untrusted attachments.
• Where technically feasible, render the Tool in a hardened browser profile or an isolated/containerized browser that is not logged into unrelated services, to limit the value of any script executing in-session.
• Enforce email and web gateway policies that flag or block JSON attachments/imports from external suppliers unless a business workflow explicitly requires them.
• Apply content security policy controls at the web tier hosting the Tool where administratively possible; the report notes no specific CSP guidance was published.

2. Patch / upgrade steps:

• Confirm with CISA / the Tool's distribution channel whether the Tool revision dated on or after 2025-12-11 is the fixed build, and upgrade to that revision.
• Because patch confidence is only CLAIMED, validate the fix does not load imported JavaScript into the page prior to initiating any submission action (i.e., re-test the described reproducer: import a JSON file with script in text fields, click "Next", confirm no script execution).
• Maintain an inventory of instances of the Tool (including locally deployed or offline copies) and ensure none remain on pre-2025-12-11 builds.

3. Long-term hardening:

• Require safe-by-default output encoding for all imported content, and treat file-import parsers as untrusted input boundaries in the Tool's SDLC.
• Add regression tests for XSS in the file import and render workflow, and include the import path in security review gates for future releases.
• Adopt a documented intake process for supplier-provided files (format validation, allowlisted schemas, no free-form HTML/script content in expected scalar text fields).

References

• NVD — CVE-2025-67634: https://nvd.nist.gov/vuln/detail/CVE-2025-67634
• CISA — Software Acquisition Guide (publisher of the affected Tool): https://www.cisa.gov/
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1204.002 — User Execution: Malicious File: https://attack.mitre.org/techniques/T1204/002/
• FIRST — CVSS v3.1 Specification Document (vector interpretation): https://www.first.org/cvss/specification-document

Exploit-in-the-wild evidence: none identified. No public PoC, exploit code, or Nuclei template is available; CVE-2025-67634 is not listed in CISA KEV, and EPSS is 0.00190 (8.0th percentile). No threat actor campaign has been associated with this CVE in the available data.