CVE-2025-6700
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts via the errorMsg parameter in the xxl-sso login endpoint. When exploited, it enables cross-site scripting attacks that can steal user credentials or session tokens. Organizations using xxl-sso 1.1.0 for single sign-on functionality are affected.
💻 Affected Systems
- Xuxueli xxl-sso
📦 What is this software?
Xxl Sso by Xuxueli
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator credentials, gain full access to the SSO system, and compromise all connected applications and user accounts.
Likely Case
Attackers steal user session cookies or credentials, enabling unauthorized access to connected applications and potential account takeover.
If Mitigated
Script execution is blocked by content security policies, limiting impact to visual defacement or minor data leakage.
🎯 Exploit Status
Exploit requires user interaction (victim must visit malicious link) but is trivial to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize the errorMsg parameter by removing HTML/script tags
Implement input sanitization in the login controller method
Content Security Policy
allImplement CSP headers to restrict script execution
Add header: Content-Security-Policy: script-src 'self'
🧯 If You Can't Patch
- Deploy a WAF with XSS protection rules to filter malicious requests
- Restrict access to the /xxl-sso-server/login endpoint to trusted networks only
🔍 How to Verify
Check if Vulnerable:
Test by sending a request to /xxl-sso-server/login with errorMsg parameter containing <script>alert('XSS')</script> and check if script executesCheck Version:
Check pom.xml or build configuration for xxl-sso version 1.1.0Verify Fix Applied:
Repeat the test after implementing fixes - script should not execute and input should be sanitized📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /xxl-sso-server/login with script tags in parameters
- Unusual error messages containing HTML/script content
Network Indicators:
- HTTP requests with encoded script payloads in URL parameters
SIEM Query:
source="web_server" AND uri="/xxl-sso-server/login" AND (param="errorMsg" AND value MATCHES "<script.*>")