CVE-2025-11435
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into the /show/submissions endpoint of JhumanJ OpnForm, leading to cross-site scripting (XSS) attacks. It affects OpnForm versions up to 1.9.3, potentially compromising user sessions and data. The vulnerability can be exploited remotely without authentication.
💻 Affected Systems
- JhumanJ OpnForm
📦 What is this software?
Opnform by Jhumanj
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal user session cookies, perform actions as authenticated users, redirect to malicious sites, or deface the application.
Likely Case
Session hijacking, credential theft, or injection of malicious content viewed by other users.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, though XSS could still affect users with active sessions.
🎯 Exploit Status
Exploit details are publicly disclosed in the provided Google Docs reference; remote exploitation is possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after commit a2af1184e53953afa8cb052f4055f288adcaa608
Vendor Advisory: https://github.com/JhumanJ/OpnForm/pull/900/commits/a2af1184e53953afa8cb052f4055f288adcaa608
Restart Required: No
Instructions:
1. Update OpnForm to a version that includes commit a2af1184e53953afa8cb052f4055f288adcaa608 or later. 2. Apply the patch from the GitHub pull request #900. 3. Verify the fix by testing the /show/submissions endpoint.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side input validation and output encoding for the /show/submissions endpoint to block malicious scripts.
Content Security Policy (CSP)
allDeploy a strict CSP header to mitigate XSS impact by restricting script execution sources.
Add HTTP header: Content-Security-Policy: default-src 'self'; script-src 'self'
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with XSS protection rules to block malicious requests.
- Disable or restrict access to the /show/submissions endpoint if not essential for operations.
🔍 How to Verify
Check if Vulnerable:
Test the /show/submissions endpoint by attempting to inject a script payload (e.g., <script>alert('XSS')</script>) and check if it executes in a browser.Check Version:
Check the OpnForm version in the application settings or via the command line if installed locally.Verify Fix Applied:
After patching, retest the /show/submissions endpoint with the same XSS payload; it should be sanitized or blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual POST/GET requests to /show/submissions with script tags or encoded payloads.
- Increased error logs related to input validation failures.
Network Indicators:
- HTTP requests containing malicious script patterns (e.g., <script>, javascript:) targeting the vulnerable endpoint.
SIEM Query:
source="web_logs" AND (url="/show/submissions" AND (content CONTAINS "<script>" OR content CONTAINS "javascript:"))