CVE-2025-21572
📋 TL;DR
OpenGrok 1.13.25 contains a reflected Cross-Site Scripting (XSS) vulnerability in its history view page due to improper sanitization of path segments. This allows attackers to inject malicious scripts that execute in victims' browsers when they visit crafted URLs. Organizations using OpenGrok for source code browsing are affected.
💻 Affected Systems
- OpenGrok
📦 What is this software?
Opengrok by Oracle
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on user systems.
Likely Case
Session hijacking leading to unauthorized access to source code repositories, credential theft, or defacement of the OpenGrok interface.
If Mitigated
Limited impact with proper input validation, output encoding, and Content Security Policy (CSP) headers in place.
🎯 Exploit Status
Reflected XSS typically requires user interaction (clicking malicious link) but is straightforward to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Oracle security advisories for patched version
Vendor Advisory: https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html
Restart Required: Yes
Instructions:
1. Check Oracle security advisory for patched version
2. Upgrade OpenGrok to patched version
3. Restart OpenGrok service
4. Verify fix by testing XSS payloads
🔧 Temporary Workarounds
Implement Web Application Firewall (WAF)
allDeploy WAF with XSS protection rules to block malicious payloads
Add Content Security Policy
allImplement strict CSP headers to mitigate script injection
Add 'Content-Security-Policy: default-src 'self'' to web server configuration
🧯 If You Can't Patch
- Restrict access to OpenGrok using network segmentation or authentication
- Disable history view functionality if not required
🔍 How to Verify
Check if Vulnerable:
Test by injecting XSS payloads in path parameters of history view URLs and checking if scripts executeCheck Version:
Check OpenGrok version in web interface or configuration filesVerify Fix Applied:
Retest XSS payloads after patching; scripts should be properly sanitized and not execute📡 Detection & Monitoring
Log Indicators:
- Unusual long URLs with script tags in access logs
- Multiple failed XSS attempts
Network Indicators:
- HTTP requests containing script tags or JavaScript in URL parameters
SIEM Query:
web.url:*script* OR web.url:*javascript:* AND dest.app:"opengrok"