StarSea99 starsea-mall アップデートにおけるクロスサイトスクリプティング

Successful exploitation of CVE-2025-2086 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to the theft of sensitive information, such as cookies and session tokens, enabling the attacker to impersonate the user. The attacker could also modify the content of the page, redirect users to malicious websites, or launch further attacks against the user's system. Given the nature of XSS, the impact can range from minor annoyance to complete compromise of user accounts and data.

Starsea-mall deployments, particularly those running version 1.0, are at risk. Shared hosting environments where multiple users share the same instance of starsea-mall are especially vulnerable, as an attacker could potentially compromise other users' accounts through this XSS vulnerability.

1. 2025-03-07Disclosure

   disclosure

1. 予約済み2025-03-07
2. 公開日2025-03-07
3. EPSS 更新日2026-04-02

The primary mitigation for CVE-2025-2086 is to upgrade starsea-mall to version 1.0.1 or later, which contains the fix. If upgrading immediately is not possible, consider implementing input validation and sanitization on the redirectUrl parameter to prevent malicious input. Web application firewalls (WAFs) configured to detect and block XSS attacks can also provide a temporary layer of protection. Review and harden the application's security configuration to minimize the attack surface.