CVE-2025-15146
📋 TL;DR
This vulnerability allows remote attackers to inject malicious scripts into the SohuTV CacheCloud user management interface via the doUserList function. Users who view the compromised user list page could have their sessions hijacked or be redirected to malicious sites. Affects all deployments of SohuTV CacheCloud up to version 3.2.0.
💻 Affected Systems
- SohuTV CacheCloud
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, perform session hijacking, redirect users to phishing sites, or execute arbitrary actions in the context of authenticated users.
Likely Case
Session hijacking leading to unauthorized access to the CacheCloud management interface, potentially allowing configuration changes or data exposure.
If Mitigated
Limited to session token theft or minor UI manipulation if proper Content Security Policy and input validation are implemented.
🎯 Exploit Status
Exploit details are publicly available in GitHub issue #366. Attack requires user interaction (viewing the compromised page).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Monitor GitHub repository for updates. Consider implementing workarounds or migrating to alternative solutions.
🔧 Temporary Workarounds
Implement Content Security Policy
allAdd CSP headers to prevent script execution from untrusted sources
Add to web server configuration: Content-Security-Policy: default-src 'self'; script-src 'self'
Input Validation Filter
allAdd input sanitization to the doUserList function to strip HTML/JavaScript
Modify src/main/java/com/sohu/cache/web/controller/UserManageController.java to sanitize user input with HTML escaping
🧯 If You Can't Patch
- Restrict access to the CacheCloud management interface to trusted networks only
- Implement a Web Application Firewall (WAF) with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check if CacheCloud version is 3.2.0 or earlier. Review UserManageController.java for lack of input sanitization in doUserList function.Check Version:
Check application.properties or pom.xml for version information, or run: java -jar cachecloud-web.jar --versionVerify Fix Applied:
Verify that user input in the user management interface is properly HTML-encoded and cannot execute JavaScript.📡 Detection & Monitoring
Log Indicators:
- Unusual long parameter values in /user/manage/list requests
- JavaScript patterns in user management queries
Network Indicators:
- HTTP requests to /user/manage/list with script tags or JavaScript in parameters
SIEM Query:
web.url.path:"/user/manage/list" AND (web.url.query:*<script* OR web.url.query:*javascript:* OR web.url.query.length>500)