CVE-2025-11147
📋 TL;DR
This reflected cross-site scripting (XSS) vulnerability in Apt-Cacher-NG allows attackers to inject malicious scripts into HTML files served by the application. When users access specially crafted URLs containing the malicious scripts, their browsers execute the code in the context of the Apt-Cacher-NG web interface. This affects organizations using vulnerable versions of Apt-Cacher-NG with internet-facing or internal deployments.
💻 Affected Systems
- Apt-Cacher-NG
📦 What is this software?
Apt Cacher Ng by Apt Cacher Ng Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, redirect users to malicious sites, or deploy malware through the web interface.
Likely Case
Session hijacking, credential theft, or defacement of the Apt-Cacher-NG web interface through script execution in user browsers.
If Mitigated
Limited impact with proper input validation and output encoding, potentially only affecting users who click malicious links.
🎯 Exploit Status
Requires user interaction (clicking malicious link) and knowledge of the target's Apt-Cacher-NG URL structure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after v3.2.1
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apt-cacher-ng
Restart Required: No
Instructions:
1. Check current Apt-Cacher-NG version. 2. Update to latest version via package manager. 3. Verify update completed successfully.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall or input validation to block malicious script patterns in URL parameters.
# Example mod_security rule: SecRule ARGS "<script" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to restrict script execution sources.
- Restrict network access to Apt-Cacher-NG web interface using firewall rules.
🔍 How to Verify
Check if Vulnerable:
Check if Apt-Cacher-NG version is v3.2.1 and test for XSS via /html/*.html endpoints with payloads like <script>alert('XSS')</script>.Check Version:
apt-cacher-ng --versionVerify Fix Applied:
After updating, test same XSS payloads to confirm they are properly sanitized and no longer execute.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /html/*.html containing script tags or JavaScript code
- Multiple failed attempts with encoded script payloads
Network Indicators:
- HTTP requests with suspicious parameters in URLs targeting Apt-Cacher-NG
SIEM Query:
source="apt-cacher-ng" AND (url="*<script*" OR url="*javascript:*")