ytti Oxidized Web conf_search.haml cross site scripting

Successful exploitation of CVE-2019-25088 allows an attacker to inject arbitrary JavaScript code into the Oxidized Web application. This can lead to various malicious outcomes, including session hijacking, defacement of the web interface, and theft of sensitive user data. The attacker can trigger the XSS vulnerability by manipulating the 'toresearch' argument, likely within the 'confsearch.haml' view. While the CVSS score is LOW, the potential for user compromise and data theft warrants immediate attention and remediation.

Organizations utilizing Oxidized Web, particularly those with custom configurations or integrations, are at risk. Systems with older, unpatched versions of Oxidized Web are especially vulnerable. Shared hosting environments where multiple users share the same Oxidized Web instance could also be affected, as an attacker could potentially compromise other users' accounts.

1. 2022-12-27Disclosure

   disclosure

1. Gereserveerd2022-12-27
2. Gepubliceerd2022-12-27
3. Gewijzigd2024-08-05
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2019-25088 is to apply the provided patch: 55ab9bdc68b03ebce9280b8746ef31d7fdedcc45. This patch directly addresses the vulnerability by sanitizing the 'toresearch' argument. If applying the patch immediately is not feasible, consider implementing input validation and output encoding on the 'toresearch' parameter to prevent malicious script injection. After applying the patch, verify the fix by attempting to inject a simple JavaScript payload through the 'conf_search' functionality and confirming that it is properly sanitized.