Zenvia Movidesk Profile Editing EditProfile cross site scripting

Successful exploitation of CVE-2025-0971 allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can lead to various malicious outcomes, including session hijacking, credential theft, and defacement of the Movidesk interface. The attacker could potentially gain access to sensitive user data or perform actions on behalf of the compromised user. Given the remote nature of the exploit, any user accessing the /Account/EditProfile endpoint is potentially at risk. The impact is amplified if Movidesk is used to manage sensitive data or control critical systems.

Organizations using Movidesk for remote access and support are particularly at risk, especially those with legacy configurations or shared hosting environments. Users who frequently modify their profile information through the /Account/EditProfile endpoint are also directly exposed.

• linux / server:

journalctl -u movidesk -f | grep -i 'username='

• generic web:

curl -s 'https://<movidesk_server>/Account/EditProfile?username=<malicious_script>' | grep -i '<script>' # Check for script injection in response

1. 2025-02-02Disclosure

   disclosure

1. 予約済み2025-02-02
2. 公開日2025-02-02
3. 更新日2025-02-12
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2025-0971 is to immediately upgrade Movidesk to version 25.01.22.245a473c54 or later. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the username parameter within the /Account/EditProfile endpoint to prevent the injection of malicious scripts. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Monitor access logs for suspicious activity related to the /Account/EditProfile endpoint, looking for unusual characters or patterns in the username parameter.