CVE-2025-15145
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in SohuTV CacheCloud up to version 3.2.0 that allows attackers to inject malicious scripts via the doTotalList function. The vulnerability can be exploited remotely without authentication, potentially affecting any user accessing the vulnerable web interface. The project maintainers have been notified but haven't responded or released a fix.
💻 Affected Systems
- SohuTV CacheCloud
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect users to malicious sites, or deface the web interface.
Likely Case
Session hijacking, credential theft, or malicious script execution in users' browsers when they access the vulnerable endpoint.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, or if the vulnerable endpoint is not exposed.
🎯 Exploit Status
Exploit details are publicly disclosed in GitHub issues; remote exploitation is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: None
Restart Required: No
Instructions:
No official patch available. Monitor the GitHub repository for updates or consider applying community fixes.
🔧 Temporary Workarounds
Input Validation and Output Encoding
allImplement proper input validation and output encoding in the doTotalList function to sanitize user inputs.
Web Application Firewall (WAF)
allDeploy a WAF with XSS protection rules to filter malicious payloads before they reach the application.
🧯 If You Can't Patch
- Restrict access to the vulnerable endpoint using network ACLs or authentication.
- Implement Content Security Policy (CSP) headers to mitigate script injection impact.
🔍 How to Verify
Check if Vulnerable:
Check if CacheCloud version is ≤3.2.0 and if the doTotalList endpoint is accessible.Check Version:
Check application configuration or deployment files for version information.Verify Fix Applied:
Test the doTotalList endpoint with XSS payloads; if sanitized or blocked, the fix is likely applied.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /totalManage/doTotalList with script tags or JavaScript payloads
Network Indicators:
- HTTP requests containing malicious script patterns targeting the vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="/totalManage/doTotalList" AND (content CONTAINS "<script>" OR content CONTAINS "javascript:")