CVE-2025-25929
📋 TL;DR
This reflected cross-site scripting (XSS) vulnerability in OpenMRS allows attackers to inject malicious JavaScript via the reportType parameter in the /legacyui/quickReportServlet component. When exploited, this enables attackers to execute arbitrary code in the context of a victim's browser session. All users of OpenMRS 2.4.3 Build 0ff0ed are affected.
💻 Affected Systems
- OpenMRS
📦 What is this software?
Openmrs by Openmrs
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware via drive-by downloads.
Likely Case
Session hijacking, credential theft, or defacement of the application interface through injected content.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, though some user interface manipulation may still occur.
🎯 Exploit Status
Exploitation requires tricking a user into clicking a malicious link containing the payload in the reportType parameter
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version of OpenMRS if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize the reportType parameter
Implement regex filtering: ^[a-zA-Z0-9_-]+$ for reportType parameter
Output Encoding
allApply proper output encoding to all user-controlled data in the response
Use HTML entity encoding for special characters: &, <, >, ", '
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with XSS protection rules
- Disable or restrict access to the /legacyui/quickReportServlet endpoint if not required
🔍 How to Verify
Check if Vulnerable:
Test by injecting a simple XSS payload like <script>alert('XSS')</script> into the reportType parameter and checking if it executesCheck Version:
Check OpenMRS version in web interface or configuration filesVerify Fix Applied:
After implementing fixes, test with the same payload to ensure it's properly sanitized and doesn't execute📡 Detection & Monitoring
Log Indicators:
- Unusual reportType parameter values containing script tags or JavaScript code
- Multiple failed requests to /legacyui/quickReportServlet with suspicious parameters
Network Indicators:
- HTTP requests to /legacyui/quickReportServlet with encoded script tags in parameters
SIEM Query:
source="web_server" AND uri="/legacyui/quickReportServlet" AND (param="reportType" AND value MATCHES "(?i)<script|javascript:")