CVE-2025-62722
📋 TL;DR
This is a Stored Cross-Site Scripting (XSS) vulnerability in LinkAce's social media sharing functionality that allows authenticated users to inject malicious JavaScript into link titles. When other users view the link details page, the malicious code executes in their browsers, potentially compromising their accounts. This affects all LinkAce instances running version 2.3.1 or earlier.
💻 Affected Systems
- LinkAce
📦 What is this software?
Linkace by Linkace
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users (including administrators), deliver malware to users' browsers, or compromise the entire LinkAce instance.
Likely Case
Authenticated attackers could steal session cookies from other users, potentially gaining unauthorized access to their accounts and performing actions on their behalf.
If Mitigated
With proper input validation and output encoding, the malicious payload would be rendered harmless as plain text rather than executable code.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple - attackers just need to create a link with malicious HTML/JavaScript in the title field.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.0
Vendor Advisory: https://github.com/Kovah/LinkAce/security/advisories/GHSA-4mxh-7c7f-q79j
Restart Required: Yes
Instructions:
1. Backup your LinkAce database and files. 2. Download LinkAce v2.4.0 from GitHub releases. 3. Replace existing installation files with new version. 4. Run database migrations: php artisan migrate. 5. Clear cache: php artisan cache:clear. 6. Restart web server.
🔧 Temporary Workarounds
Disable Social Media Sharing
allTemporarily disable the social media sharing functionality to prevent exploitation
Edit .env file and set SHOW_SHARE_BUTTONS=false
Clear cache: php artisan cache:clear
Input Validation Filter
allAdd custom input validation to sanitize link titles
Add HTMLPurifier or similar sanitization to link creation/update endpoints
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to block inline JavaScript execution
- Enable HTTP-only and Secure flags on session cookies to limit cookie theft impact
🔍 How to Verify
Check if Vulnerable:
Check LinkAce version in admin panel or via command: php artisan --version. If version is 2.3.1 or lower, you are vulnerable.Check Version:
php artisan --versionVerify Fix Applied:
After patching, verify version is 2.4.0 or higher. Test by creating a link with HTML in title field - it should be displayed as plain text, not executed.📡 Detection & Monitoring
Log Indicators:
- Unusual link creation patterns
- Multiple links created by single user with HTML tags in titles
- JavaScript alert() or similar functions in link titles
Network Indicators:
- Unexpected outbound connections from LinkAce server after viewing links
- Cookie theft attempts to external domains
SIEM Query:
source="linkace" AND (title CONTAINS "<script>" OR title CONTAINS "javascript:" OR title CONTAINS "onerror=" OR title CONTAINS "onload=")