CVE-2025-70368
📋 TL;DR
Worklenz version 2.1.5 contains a stored XSS vulnerability in the Project Updates feature. An attacker can inject malicious JavaScript into the Updates text field, which executes in victims' browsers when they view the reporting page. This affects all users of Worklenz 2.1.5 who have access to project updates.
💻 Affected Systems
- Worklenz
📦 What is this software?
Worklenz by Worklenz
⚠️ Risk & Real-World Impact
Worst Case
Attacker steals session cookies, performs account takeover, and accesses sensitive project data or executes administrative actions as authenticated users.
Likely Case
Attacker steals session tokens to hijack user accounts, potentially accessing confidential project information or modifying data.
If Mitigated
Limited to stealing session cookies from users who view malicious updates, with proper CSP headers reducing impact.
🎯 Exploit Status
Exploitation requires authenticated access to submit project updates. Public proof-of-concept demonstrates payload injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://github.com/Worklenz/worklenz
Restart Required: No
Instructions:
Monitor Worklenz repository for security updates. Apply patch when available by updating to fixed version.
🔧 Temporary Workarounds
Input Sanitization
allImplement server-side input validation and output encoding for Project Updates field.
Content Security Policy
allImplement strict CSP headers to prevent script execution from untrusted sources.
Content-Security-Policy: default-src 'self'; script-src 'self'
🧯 If You Can't Patch
- Disable Project Updates feature if not required
- Restrict user permissions to submit project updates to trusted administrators only
🔍 How to Verify
Check if Vulnerable:
Test by submitting <script>alert('XSS')</script> in Project Updates field and checking if it executes in reporting view.Check Version:
Check Worklenz version in application settings or package.json file.Verify Fix Applied:
Verify that submitted script payloads are properly sanitized and do not execute in browser.📡 Detection & Monitoring
Log Indicators:
- Unusual length or pattern in project update submissions
- JavaScript patterns in update content
Network Indicators:
- Unexpected external script loads from project update pages
SIEM Query:
source="worklenz" AND (message="*<script>*" OR message="*javascript:*")