CVE-2025-60646
📋 TL;DR
This stored XSS vulnerability in Xxl-api v1.3.0 allows attackers to inject malicious scripts into the Business Line Management module's Name parameter. When other users view the affected page, their browsers execute the attacker's code. Anyone using the vulnerable version of Xxl-api is affected.
💻 Affected Systems
- Xxl-api
📦 What is this software?
Xxl Api by Xuxueli
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on user systems.
Likely Case
Session hijacking, credential theft, defacement of the application interface, or data exfiltration from user browsers.
If Mitigated
Limited impact with proper input validation and output encoding, potentially only affecting UI display without code execution.
🎯 Exploit Status
Exploitation requires ability to modify the Name parameter in the Business Line Management module. Public proof-of-concept available in GitHub references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://github.com/xuxueli/xxl-api/issues/65
Restart Required: No
Instructions:
1. Monitor GitHub repository for patches. 2. Implement input validation and output encoding. 3. Consider upgrading if newer versions are available.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to sanitize Name parameter inputs
Implement regex filter: /^[a-zA-Z0-9\s\-_.]+$/ for Name field
Output Encoding
allApply proper HTML encoding when displaying Name parameter values
Use HTML entity encoding: < for <, > for >, & for &, " for ", ' for '
🧯 If You Can't Patch
- Implement WAF rules to block XSS payloads in Name parameter
- Restrict access to Business Line Management module to trusted users only
🔍 How to Verify
Check if Vulnerable:
Test by injecting <script>alert('XSS')</script> into Name parameter of Business Line Management moduleCheck Version:
Check package.json or application configuration for version numberVerify Fix Applied:
Verify injected scripts no longer execute when viewing the affected page📡 Detection & Monitoring
Log Indicators:
- Unusual characters in Name parameter logs
- Multiple failed validation attempts for Name field
Network Indicators:
- POST requests to Business Line Management with script tags in parameters
SIEM Query:
source="web_logs" AND (uri="/business_line" OR uri="/api/business_line") AND (param="name" AND value MATCHES "<script.*>")