CVE-2025-46545
📋 TL;DR
This vulnerability allows stored cross-site scripting (XSS) attacks in Sherpa Orchestrator version 141851. Administrators can inject malicious scripts through the license name parameter, which execute when the license expires. Only administrators with license management privileges are affected.
💻 Affected Systems
- Sherpa Orchestrator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with administrator credentials could steal session cookies, perform actions as the administrator, or redirect users to malicious sites when they view license information.
Likely Case
Privilege escalation within the application, session hijacking, or defacement of license management pages.
If Mitigated
Limited impact due to requiring administrator credentials and specific trigger condition (license expiration).
🎯 Exploit Status
Exploitation requires administrator credentials and knowledge of XSS payloads. Public proof-of-concept exists in GitHub gist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://sherparpa.com
Restart Required: No
Instructions:
1. Check vendor advisory at sherparpa.com for updates. 2. Apply any available patches. 3. Validate fix by testing license name input sanitization.
🔧 Temporary Workarounds
Input Validation for License Names
allImplement server-side validation to sanitize HTML/JavaScript from license name inputs
Implement input sanitization in license management code
Content Security Policy
allImplement CSP headers to restrict script execution
Add Content-Security-Policy header to web server configuration
🧯 If You Can't Patch
- Restrict administrator access to only trusted personnel
- Monitor license management activities and audit logs for suspicious inputs
🔍 How to Verify
Check if Vulnerable:
Test if HTML/JavaScript can be injected into license name field and persists in the systemCheck Version:
Check Sherpa Orchestrator version in administration panel or configuration filesVerify Fix Applied:
Verify that HTML/JavaScript input in license name field is properly sanitized and doesn't execute📡 Detection & Monitoring
Log Indicators:
- Unusual license name entries containing script tags or JavaScript
- Multiple license updates from single administrator
Network Indicators:
- HTTP requests with script payloads in license name parameters
SIEM Query:
Search for license management events with suspicious strings like <script>, javascript:, or eval()