SohuTV CacheCloud AppController.java appCommandAnalysis cross site scripting

The XSS vulnerability in CacheCloud allows an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can be leveraged to steal session cookies, redirect users to malicious websites, or deface the application. Given the public availability of an exploit, the risk of exploitation is significant. An attacker could potentially gain unauthorized access to sensitive data or compromise the entire CacheCloud deployment. The impact is amplified if CacheCloud is used to manage or cache sensitive user data.

Organizations utilizing SohuTV CacheCloud versions 3.0 through 3.2.0 are at risk, particularly those deploying CacheCloud in environments handling sensitive user data. Shared hosting environments where CacheCloud is installed could be vulnerable if other tenants can influence requests to the /appCommandAnalysis endpoint.

• java / server: Monitor application logs for suspicious requests to /appCommandAnalysis. Use a WAF to block requests containing potentially malicious JavaScript code.

grep -i 'script' /var/log/app/cachecloud.log

• generic web: Use curl to test the /appCommandAnalysis endpoint with a simple XSS payload (e.g., `<script>alert(1)</script>). Verify that the payload is properly encoded or sanitized.

curl -X POST -d '<script>alert(1)</script>' http://your-cachecloud-server/appCommandAnalysis

1. 2025-12-29Disclosure

   disclosure

2. 2025-12-29PoC

   poc

1. 已保留2025-12-28
2. 发布日期2025-12-29
3. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-15175 is to upgrade to CacheCloud version 3.2.1 or later, which contains the fix. If immediate upgrading is not possible, consider implementing input validation and output encoding on the doAppList/appCommandAnalysis endpoint to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Monitor application logs for suspicious activity, particularly requests targeting the vulnerable endpoint. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload through the doAppList/appCommandAnalysis endpoint and verifying that the payload is properly sanitized.