CVE-2025-15204
📋 TL;DR
This vulnerability allows remote attackers to inject malicious scripts via the doQuartzList function in SohuTV CacheCloud, leading to cross-site scripting (XSS) attacks. It affects CacheCloud versions up to 3.2.0. Attackers can exploit this remotely to potentially steal session cookies or perform actions on behalf of users.
💻 Affected Systems
- SohuTV CacheCloud
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, gain unauthorized access to the CacheCloud management interface, and potentially compromise the entire Redis cache infrastructure managed by CacheCloud.
Likely Case
Attackers inject malicious JavaScript that executes in victims' browsers, potentially stealing session tokens, redirecting users to malicious sites, or performing actions on behalf of authenticated users.
If Mitigated
With proper input validation and output encoding, the malicious scripts would be rendered harmless as text rather than executable code.
🎯 Exploit Status
The exploit has been publicly disclosed in GitHub issue #376. Attack requires access to the web interface but no authentication for the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. The vendor has not responded to the vulnerability report. Consider implementing workarounds or migrating to alternative solutions.
🔧 Temporary Workarounds
Input Validation Filter
allImplement input validation and output encoding for the doQuartzList function parameters
Modify src/main/java/com/sohu/cache/web/controller/QuartzManageController.java to sanitize user input before processing
Web Application Firewall (WAF)
allDeploy a WAF with XSS protection rules to filter malicious requests
Configure WAF to block requests containing suspicious script patterns to /quartz/* endpoints
🧯 If You Can't Patch
- Restrict network access to CacheCloud web interface using firewall rules
- Implement Content Security Policy (CSP) headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check if CacheCloud version is ≤3.2.0 and if the doQuartzList function lacks proper input sanitizationCheck Version:
Check the pom.xml file or application properties for version informationVerify Fix Applied:
Test the doQuartzList endpoint with XSS payloads and verify they are properly encoded in output📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /quartz/doQuartzList containing script tags or JavaScript code
- Multiple failed XSS attempts in web server logs
Network Indicators:
- HTTP requests with suspicious parameters containing <script>, javascript:, or other XSS payloads
SIEM Query:
source="web_server_logs" AND uri_path="/quartz/doQuartzList" AND (request_parameters CONTAINS "<script>" OR request_parameters CONTAINS "javascript:")