CVE-2025-15173
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into SohuTV CacheCloud web interface via the advancedAnalysis function. Affected users are those running CacheCloud up to version 3.2.0 with the vulnerable InstanceController component exposed. The XSS attack can be executed remotely without authentication.
💻 Affected Systems
- SohuTV CacheCloud
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, deface the interface, or redirect users to malicious sites.
Likely Case
Session hijacking leading to unauthorized access to cache management functions, potentially allowing data manipulation or service disruption.
If Mitigated
With proper input validation and output encoding, the attack would be prevented, limiting impact to failed exploitation attempts.
🎯 Exploit Status
Exploit details are publicly available in GitHub issue #369, making this easily weaponizable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch exists. Monitor GitHub repository for updates. If patched, update to fixed version and restart CacheCloud service.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize user input to the advancedAnalysis function
Modify src/main/java/com/sohu/cache/web/controller/InstanceController.java to add input sanitization
Web Application Firewall
allDeploy WAF with XSS protection rules to filter malicious requests
🧯 If You Can't Patch
- Restrict network access to CacheCloud web interface using firewall rules
- Implement Content Security Policy headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check CacheCloud version. If version <= 3.2.0 and InstanceController is accessible, system is vulnerable.Check Version:
Check pom.xml or application properties for version informationVerify Fix Applied:
Test advancedAnalysis endpoint with XSS payloads after implementing workarounds to ensure they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /instance/advancedAnalysis endpoint with script tags or JavaScript code
Network Indicators:
- HTTP requests containing <script> tags or JavaScript payloads to CacheCloud web interface
SIEM Query:
web.url:*advancedAnalysis* AND (web.query:*<script>* OR web.query:*javascript:* OR web.query:*onerror=*)