CVE-2025-65572
📋 TL;DR
This Cross-Site Scripting (XSS) vulnerability in AllskyTeam AllSky allows remote attackers to inject malicious scripts via config, filename, or extratext parameters. When users visit the allskySettings.php page, the injected scripts execute in their browser context. All users running the vulnerable version of AllSky software are affected.
💻 Affected Systems
- AllskyTeam AllSky
📦 What is this software?
Allsky by Allskyteam
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, deface the application, or redirect users to malicious sites.
Likely Case
Session hijacking leading to unauthorized access, data theft, or website defacement.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, though some risk remains.
🎯 Exploit Status
The vulnerability is well-documented with public proof-of-concept available, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Monitor the official AllSky GitHub repository for security updates. 2. Apply any available patches immediately when released. 3. Review and implement input validation and output encoding fixes.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and output encoding for the vulnerable parameters
# Modify allskySettings.php to validate and sanitize config, filename, and extratext parameters
# Add htmlspecialchars() or similar encoding to output in status_messages.php
Web Application Firewall (WAF)
allDeploy a WAF with XSS protection rules
# Configure WAF to block suspicious parameter values containing script tags or JavaScript
🧯 If You Can't Patch
- Restrict access to allskySettings.php to trusted IP addresses only
- Implement Content Security Policy (CSP) headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check if your AllSky version is v2024.12.06_06 or earlier by examining the software version in the interface or configuration files.Check Version:
grep -r 'version' /path/to/allsky/installation/ or check the web interfaceVerify Fix Applied:
Test the vulnerable parameters with XSS payloads to ensure they are properly sanitized and no longer execute.📡 Detection & Monitoring
Log Indicators:
- Unusual parameter values in access logs for allskySettings.php
- Multiple requests with script-like content in parameters
Network Indicators:
- HTTP requests containing script tags or JavaScript in config, filename, or extratext parameters
SIEM Query:
source="web_access_logs" AND uri="*allskySettings.php*" AND (param="*<script>*" OR param="*javascript:*")