CVE-2025-2361
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in Mercurial SCM's web interface. Attackers can inject malicious scripts via the 'cmd' parameter, potentially compromising user sessions or stealing credentials. Organizations using Mercurial SCM with the web interface enabled are affected.
💻 Affected Systems
- Mercurial SCM
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, compromise the Mercurial server, and potentially pivot to other systems in the network.
Likely Case
Session hijacking, credential theft, or defacement of the Mercurial web interface.
If Mitigated
Limited impact with proper input validation and output encoding in place.
🎯 Exploit Status
Exploit details are publicly available and can be executed remotely without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider workarounds or alternative solutions.
🔧 Temporary Workarounds
Disable Web Interface
allDisable the Mercurial web interface if not required.
Edit Mercurial configuration to remove or disable web interface settings
Implement WAF Rules
allAdd web application firewall rules to block malicious 'cmd' parameter values.
Add WAF rule: Block requests containing script tags or JavaScript in 'cmd' parameter
🧯 If You Can't Patch
- Restrict network access to Mercurial web interface using firewall rules
- Implement strict input validation and output encoding for the 'cmd' parameter
🔍 How to Verify
Check if Vulnerable:
Check if Mercurial version matches affected version and web interface is enabled.Check Version:
hg --versionVerify Fix Applied:
Test the 'cmd' parameter with XSS payloads to ensure they are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual 'cmd' parameter values in web server logs
- Multiple failed XSS attempts
Network Indicators:
- HTTP requests with script tags or JavaScript in 'cmd' parameter
SIEM Query:
source="mercurial_logs" AND (cmd="<script>" OR cmd="javascript:")