CVE-2025-15175
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in SohuTV CacheCloud that allows attackers to inject malicious scripts into web pages. The vulnerability affects users accessing the CacheCloud web interface and can be exploited remotely. Attackers could steal session cookies, redirect users, or perform actions on their behalf.
💻 Affected Systems
- SohuTV CacheCloud
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full control of CacheCloud instance, and compromise the entire Redis cache infrastructure.
Likely Case
Attackers steal user session cookies, perform unauthorized actions, or redirect users to malicious sites.
If Mitigated
With proper input validation and output encoding, the XSS payloads are neutralized before reaching users.
🎯 Exploit Status
Exploit details are publicly available in GitHub issues; remote exploitation requires user interaction with malicious links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and output encoding in AppController.java or upgrading if vendor releases fix.
🔧 Temporary Workarounds
Implement Content Security Policy
allAdd CSP headers to restrict script execution sources
Add 'Content-Security-Policy: default-src 'self'; script-src 'self'' to web server headers
Web Application Firewall Rules
allConfigure WAF to block XSS payloads in requests
Configure WAF to filter <script>, javascript:, and other XSS patterns in URL parameters
🧯 If You Can't Patch
- Restrict CacheCloud web interface to internal network only
- Implement strict session management with short timeouts and secure cookies
🔍 How to Verify
Check if Vulnerable:
Check if CacheCloud version is 3.2.0 or earlier and review AppController.java for lack of input sanitization in doAppList/appCommandAnalysis functionsCheck Version:
Check pom.xml or application.properties for version informationVerify Fix Applied:
Test XSS payloads in affected endpoints; successful payload execution indicates vulnerability📡 Detection & Monitoring
Log Indicators:
- Unusual long parameter values in /app/list or /app/command requests
- JavaScript patterns in URL parameters
Network Indicators:
- HTTP requests with script tags or javascript: in query parameters
SIEM Query:
web.url:*script* OR web.url:*javascript:* AND dest.port:8080 AND dest.app:"cachecloud"