SohuTV CacheCloud AppManageController.java doAppAuditList cross site scripting

Successful exploitation of CVE-2025-15174 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can be leveraged to steal sensitive information like cookies, session tokens, and user credentials. An attacker could also redirect users to malicious websites or deface the application. Given the publicly disclosed nature of the exploit, the risk of exploitation is elevated, particularly if systems are not promptly patched. The impact is amplified if CacheCloud is integrated with other systems, potentially enabling lateral movement within the network.

Organizations running SohuTV CacheCloud in production environments, particularly those with publicly accessible instances or those that integrate CacheCloud with other sensitive systems, are at risk. Shared hosting environments where multiple users share the same CacheCloud instance are also particularly vulnerable, as an attacker could potentially exploit the vulnerability to target other users.

• java / server: Monitor application logs for suspicious requests targeting the doAppAuditList endpoint. Look for unusual characters or patterns indicative of XSS payloads.

grep -i 'script|onload|onerror' /var/log/cachecloud/app.log

• generic web: Use curl to test the doAppAuditList endpoint with various payloads to identify potential XSS vulnerabilities.

curl -X POST -d '<script>alert("XSS")</script>' https://your-cachecloud-instance/app/auditList

• generic web: Examine response headers for the presence of Content Security Policy (CSP) directives. A strong CSP can mitigate the impact of XSS vulnerabilities.

curl -I https://your-cachecloud-instance/app/auditList

1. 2025-12-29Disclosure

   disclosure

2. 2025-12-29PoC

   poc

3. 2025-12-29CISA KEV

   kev

1. Réservé2025-12-28
2. Publiée2025-12-29
3. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-15174 is to upgrade SohuTV CacheCloud to version 3.2.1 or later, which contains the fix. If immediate upgrading is not feasible, consider implementing input validation and output encoding on the doAppAuditList endpoint to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Thoroughly review and update any custom code interacting with the doAppAuditList function to ensure proper sanitization.