CVE-2025-15201
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in SohuTV CacheCloud up to version 3.2.0. The flaw in the redirectNoPower function allows attackers to inject malicious scripts that execute in users' browsers. Organizations using vulnerable CacheCloud instances are affected, particularly if the application is internet-facing.
💻 Affected Systems
- SohuTV CacheCloud
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users, potentially leading to account compromise or data theft.
Likely Case
Attackers inject malicious scripts to steal session tokens or credentials from users who interact with the vulnerable endpoint.
If Mitigated
With proper input validation and output encoding, the impact is limited to script execution in isolated browser contexts without access to sensitive data.
🎯 Exploit Status
The exploit has been published and remote exploitation is possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch is available. Monitor the GitHub repository for updates.
🔧 Temporary Workarounds
Implement WAF Rules
allDeploy a web application firewall with XSS detection and prevention rules to block malicious payloads.
Input Validation Filter
allAdd server-side input validation to sanitize user inputs before processing in the redirectNoPower function.
🧯 If You Can't Patch
- Restrict access to the CacheCloud application using network segmentation or firewall rules to limit exposure.
- Implement Content Security Policy (CSP) headers to mitigate the impact of successful XSS attacks.
🔍 How to Verify
Check if Vulnerable:
Check if CacheCloud version is 3.2.0 or earlier by examining the application version in the web interface or configuration files.Check Version:
Check application.properties or similar configuration files for version information.Verify Fix Applied:
Test the redirectNoPower endpoint with XSS payloads to confirm they are properly sanitized or blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /redirectNoPower endpoint with script tags or JavaScript payloads in parameters
Network Indicators:
- HTTP requests containing <script> tags or JavaScript code in URL parameters
SIEM Query:
web.url:*redirectNoPower* AND (web.param:*<script>* OR web.param:*javascript:*)