CVE-2025-57244
📋 TL;DR
OpenKM Community Edition 6.3.12 has a stored cross-site scripting (XSS) vulnerability in the user account creation interface. Attackers can inject malicious scripts into the Name field or bypass frontend validation in the Email field using encoded script tags. This affects all users of OpenKM Community Edition 6.3.12 who have access to create user accounts.
💻 Affected Systems
- OpenKM Community Edition
📦 What is this software?
Openkm by Openkm
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform account takeover, deface the application, or redirect users to malicious sites, potentially leading to complete system compromise.
Likely Case
Attackers with access to create user accounts could inject malicious scripts that execute in other users' browsers, potentially stealing session cookies or performing actions on behalf of authenticated users.
If Mitigated
With proper input validation and output encoding, the malicious scripts would be neutralized, preventing execution in user browsers.
🎯 Exploit Status
Exploitation requires access to create user accounts. The vulnerability is well-documented with public proof-of-concept available in the GitHub references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Implement server-side input validation and output encoding for all user inputs in the account creation interface.
🔧 Temporary Workarounds
Implement Server-Side Input Validation
allAdd server-side validation to sanitize and validate Name and Email fields, rejecting any input containing script tags or encoded script tags.
Enable Content Security Policy (CSP)
allImplement a strict Content Security Policy header to prevent execution of inline scripts and restrict script sources.
Add to web server configuration: Content-Security-Policy: default-src 'self'; script-src 'self'
🧯 If You Can't Patch
- Disable user account creation functionality if not required
- Implement a web application firewall (WAF) with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Attempt to create a user account with script tags in the Name field (e.g., <script>alert('XSS')</script>) or encoded script tags in the Email field via POST request modification.Check Version:
Check OpenKM version in administration interface or via application filesVerify Fix Applied:
Test that script tags in Name field are rejected and encoded script tags in Email field are properly sanitized. Verify that malicious scripts do not execute when viewing user accounts.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to user creation endpoint with script-like content
- Multiple failed user creation attempts with suspicious inputs
Network Indicators:
- HTTP requests containing script tags or encoded script tags in user creation parameters
SIEM Query:
source="web_server" AND ("<script>" OR "%3Cscript%3E") AND uri="/user/create"