SohuTV CacheCloud LoginController.java init cross site scripting

Successful exploitation of CVE-2025-15220 allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can lead to a wide range of malicious activities, including stealing session cookies, redirecting users to phishing sites, and injecting malicious content into the application. The remote nature of the vulnerability means an attacker doesn't need to be on the same network as the CacheCloud server. Given the public availability of an exploit, the risk of immediate exploitation is elevated. The potential impact extends to any user interacting with the vulnerable CacheCloud application, particularly those logging in or accessing user-specific data.

Organizations utilizing SohuTV CacheCloud versions 3.0 through 3.2.0 are at risk. This includes those deploying CacheCloud in production environments, particularly those handling sensitive user data or integrating with other critical systems. Shared hosting environments using CacheCloud are also at increased risk due to the potential for cross-tenant exploitation.

• java / server: Examine application logs for unusual characters or patterns in login requests. Use a debugger to step through the LoginController.java code and observe how user input is handled. • generic web: Use curl to test the login endpoint with various XSS payloads (e.g., <script>alert(1)</script>). Check response headers for Content-Security-Policy (CSP) settings. • generic web: Monitor network traffic for suspicious requests originating from the CacheCloud server. • generic web: Use a web application scanner to identify potential XSS vulnerabilities.

1. 2025-12-30Disclosure

   disclosure

2. 2025-12-30PoC

   poc

1. Gereserveerd2025-12-28
2. Gepubliceerd2025-12-30
3. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-15220 is to upgrade to SohuTV CacheCloud version 3.2.1 or later. If immediate upgrading is not possible, consider implementing temporary workarounds such as strict input validation and output encoding on user-supplied data within the LoginController.java file. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a layer of protection. Monitor application logs for suspicious activity, particularly requests containing unusual characters or patterns that might indicate an attempted XSS attack. After upgrading, confirm the fix by attempting to inject a simple XSS payload through the login form and verifying that it is properly sanitized.