CVE-2025-15202
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into the SohuTV CacheCloud web interface via the taskQueueList function. When users view affected pages, these scripts execute in their browsers, potentially stealing session cookies or performing unauthorized actions. Only SohuTV CacheCloud installations up to version 3.2.0 are affected.
💻 Affected Systems
- SohuTV CacheCloud
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full administrative access to CacheCloud, and potentially compromise the entire Redis caching infrastructure.
Likely Case
Attackers steal user session cookies to impersonate legitimate users, modify cache configurations, or deface the web interface.
If Mitigated
With proper input validation and output encoding, malicious scripts are neutralized before reaching users' browsers.
🎯 Exploit Status
Exploit details are publicly available in GitHub issue #374. Attack requires user interaction (viewing malicious page).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Monitor GitHub repository for updates or apply workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize user input in the taskQueueList function before processing.
Modify src/main/java/com/sohu/cache/web/controller/TaskController.java to implement proper input sanitization
Output Encoding
allImplement output encoding in the web templates to neutralize any malicious scripts before rendering.
Update JSP/HTML templates to use proper output encoding functions
🧯 If You Can't Patch
- Restrict access to CacheCloud web interface using network segmentation or firewall rules
- Implement Content Security Policy (CSP) headers to restrict script execution
🔍 How to Verify
Check if Vulnerable:
Check CacheCloud version in web interface or configuration files. If version ≤ 3.2.0, system is vulnerable.Check Version:
Check application.properties or web interface footer for version informationVerify Fix Applied:
Test taskQueueList function with XSS payloads after applying fixes to ensure scripts are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual task creation/modification requests
- Requests containing script tags or JavaScript in parameters
Network Indicators:
- HTTP requests to taskQueueList endpoint with suspicious parameters
SIEM Query:
web_access_logs WHERE uri LIKE '%taskQueueList%' AND (params CONTAINS '<script' OR params CONTAINS 'javascript:')