aitangbao springboot-manager add cross site scripting

Successful exploitation of CVE-2025-2211 allows an attacker to inject arbitrary JavaScript code into the springboot-manager application. This code can then be executed in the context of a victim's browser when they access a vulnerable page. The attacker could steal session cookies, redirect users to malicious websites, or deface the application. The vulnerability's remote accessibility significantly broadens the potential attack surface, as it doesn't require local access to the system. The lack of vendor response raises concerns about the overall security posture of the application and potential unaddressed vulnerabilities.

Organizations using aitangbao springboot-manager version 3.0, particularly those with publicly accessible instances of the application, are at risk. Shared hosting environments where multiple users share the same instance of springboot-manager are also particularly vulnerable, as an attacker could potentially compromise other users' accounts.

• java / server:

find / -name "springboot-manager*" -type d -exec grep -i "sysDictDetail/add" {} \;

• generic web:

curl -s -X POST -d "name=<script>alert('XSS')</script>" http://your-springboot-manager-url/sysDictDetail/add | grep "<script>alert('XSS')</script>"

1. 2025-03-11Disclosure

   disclosure

1. 予約済み2025-03-11
2. 公開日2025-03-11
3. 更新日2025-03-12
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2025-2211 is to upgrade to springboot-manager version 3.0.1 or later, which contains the fix. If upgrading immediately is not feasible, consider implementing input validation and sanitization on the /sysDictDetail/add endpoint to prevent the injection of malicious scripts. Web application firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly review and update input validation routines to prevent similar vulnerabilities from arising in the future. After upgrade, confirm by testing the /sysDictDetail/add endpoint with various input strings to ensure no XSS payloads are executed.