CVE-2025-11146
📋 TL;DR
CVE-2025-11146 is a reflected cross-site scripting vulnerability in Apt-Cacher-NG's web management interface that allows attackers to inject malicious scripts via manipulated URLs. When exploited, this can lead to session hijacking, credential theft, or unauthorized administrative actions. Organizations running Apt-Cacher-NG web management interfaces accessible to untrusted users are affected.
💻 Affected Systems
- Apt-Cacher-NG
📦 What is this software?
Apt Cacher Ng by Apt Cacher Ng Project
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains administrative control of Apt-Cacher-NG, modifies package repositories to distribute malware, steals administrator credentials, and pivots to internal network systems.
Likely Case
Attacker steals session cookies or credentials from administrators who click malicious links, leading to unauthorized access to the caching proxy management interface.
If Mitigated
With proper network segmentation and access controls, impact is limited to the Apt-Cacher-NG management interface only, preventing lateral movement.
🎯 Exploit Status
Reflected XSS typically requires user interaction (clicking malicious link). No authentication required to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for patched version
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apt-cacher-ng
Restart Required: Yes
Instructions:
1. Check vendor advisory for patched version. 2. Update Apt-Cacher-NG to patched version. 3. Restart Apt-Cacher-NG service. 4. Verify fix by testing /acng-report.html endpoint.
🔧 Temporary Workarounds
Disable web management interface
LinuxDisable the web management interface if not required for operations
Edit Apt-Cacher-NG configuration to disable AdminAuth and ReportPage
Restart service: systemctl restart apt-cacher-ng
Network access restrictions
LinuxRestrict access to Apt-Cacher-NG web interface to trusted IPs only
Configure firewall rules: iptables -A INPUT -p tcp --dport 3142 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 3142 -j DROP
🧯 If You Can't Patch
- Implement strict Content Security Policy headers to mitigate XSS impact
- Deploy web application firewall with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Test /acng-report.html endpoint with XSS payload in URL parameters: http://server:3142/acng-report.html?test=<script>alert('XSS')</script>Check Version:
apt-cacher-ng --version or check package manager: dpkg -l apt-cacher-ngVerify Fix Applied:
After patching, repeat XSS test - script should not execute and input should be properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual long URLs with script tags in access logs
- Multiple requests to /acng-report.html with encoded characters
Network Indicators:
- HTTP requests containing <script> tags in URL parameters
- Unusual referrer headers pointing to /acng-report.html
SIEM Query:
source="apt-cacher-ng" AND url="*acng-report.html*" AND (url="*%3Cscript%3E*" OR url="*<script>*")