CVE-2025-30087
📋 TL;DR
This cross-site scripting (XSS) vulnerability in Best Practical RT allows attackers to inject malicious scripts into search URLs. When users view search results containing crafted parameters, the scripts execute in their browsers. This affects RT versions 4.4 through 4.4.7 and 5.0 through 5.0.7.
💻 Affected Systems
- Best Practical Request Tracker (RT)
📦 What is this software?
Request Tracker by Bestpractical
Request Tracker by Bestpractical
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or compromise user accounts.
Likely Case
Session hijacking, credential theft, or defacement of search result pages.
If Mitigated
Limited impact with proper content security policies and input validation controls.
🎯 Exploit Status
XSS vulnerabilities typically have low exploitation complexity, especially when unauthenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.8 and 5.0.8
Vendor Advisory: https://docs.bestpractical.com/release-notes/rt/index.html
Restart Required: Yes
Instructions:
1. Backup your RT installation and database. 2. Download RT 4.4.8 or 5.0.8 from Best Practical. 3. Follow the upgrade instructions for your version. 4. Restart your web server and RT services.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side filtering of search parameters to remove or encode special characters.
# Requires custom code modification to RT's search handler
Content Security Policy
allImplement strict CSP headers to prevent script execution from untrusted sources.
# Add to web server config: Content-Security-Policy: default-src 'self'
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS patterns in search parameters.
- Disable or restrict search functionality for unauthenticated users if possible.
🔍 How to Verify
Check if Vulnerable:
Check your RT version against affected ranges. Test by attempting to inject basic XSS payloads in search parameters.Check Version:
rt-crontool --version or check RT_SiteConfig.pmVerify Fix Applied:
Verify installation of RT 4.4.8 or 5.0.8. Test that XSS payloads in search parameters are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual search queries with script tags or JavaScript code
- Multiple failed search attempts with special characters
Network Indicators:
- HTTP requests with suspicious parameters containing <script>, javascript:, or encoded payloads
SIEM Query:
web.url:*search* AND (web.param:*<script>* OR web.param:*javascript:* OR web.param:*%3Cscript%3E*)