CVE-2025-0666: BOINC Server Stored XSS Vulnerability

CVE-2025-0666 Overview

CVE-2025-0666 is a stored Cross-Site Scripting (XSS) vulnerability in BOINC Server, the server-side component of the Berkeley Open Infrastructure for Network Computing (BOINC) volunteer distributed-computing platform maintained by the University of California. The flaw affects all BOINC Server releases through version 1.4.7 and is classified under CWE-79. An unauthenticated attacker can inject persistent script payloads that execute in the browser of any user who later views the affected page. The issue was documented in Compass Security advisory CSNC-2025-002.

Critical Impact
Attackers can persistently inject JavaScript into BOINC Server web pages, enabling session hijacking, credential theft, and takeover of administrator accounts.

Affected Products

BOINC Server versions up to and including 1.4.7
Deployments operated by projects hosting scientific computing workloads on BOINC
Web-facing BOINC project sites exposing forums, profiles, or team pages

Discovery Timeline

2025-05-07 - CVE-2025-0666 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0666

Vulnerability Analysis

BOINC Server exposes several PHP-based web components for user profiles, team pages, forums, and project management. The application accepts user-supplied input and stores it in the backend database. When that input is later rendered in HTML responses, the server fails to neutralize markup and script content. As a result, attacker-controlled payloads persist and execute in the context of the BOINC project domain each time a victim loads the affected page.

Exploitation requires user interaction, since the payload only fires when a target visits the poisoned page. The confidentiality and integrity impact is significant because BOINC projects typically share authentication cookies between public forum pages and privileged administrative interfaces. Successful exploitation gives an attacker access to session tokens, cross-site request forgery primitives, and the ability to pivot into administrator workflows.

Root Cause

The root cause is improper neutralization of input during web page generation. BOINC Server components store user data verbatim and emit it into HTML without consistent contextual output encoding or a strict Content Security Policy. Sinks that write to HTML, attribute, and JavaScript contexts do not apply the encoding required for each context.

Attack Vector

An unauthenticated attacker submits crafted content through any BOINC feature that persists user input, such as profile fields, team descriptions, or forum posts. The malicious markup is stored by the server. When another user, including a project administrator, browses the page, the browser executes the payload with the privileges of that user's session on the BOINC project origin.

A detailed description of the affected endpoints is available in the Compass Security Advisory CSNC-2025-002.

Detection Methods for CVE-2025-0666

Indicators of Compromise

Stored user records containing <script>, onerror=, onload=, or javascript: sequences in profile, team, or forum tables
Outbound requests from administrator browsers to unknown domains shortly after viewing BOINC pages
Unexpected privilege changes or new administrator accounts created from active administrator sessions

Detection Strategies

Review web server access logs for POST requests to profile, team, and forum endpoints containing HTML or JavaScript syntax in parameter values
Query the BOINC database for stored fields containing script tags, event handlers, or encoded variants such as <script
Deploy a Content Security Policy in report-only mode and monitor violation reports for inline script execution on BOINC pages

Monitoring Recommendations

Alert on administrator session cookies used from IP addresses or user agents that differ from the administrator's baseline
Monitor for anomalous DOM modifications and outbound fetch or XMLHttpRequest calls originating from BOINC domains
Correlate web application firewall XSS signatures with authenticated user activity to identify successful stored payload injection

How to Mitigate CVE-2025-0666

Immediate Actions Required

Upgrade BOINC Server to a release later than 1.4.7 that addresses the stored XSS defects described in CSNC-2025-002
Audit user-generated content tables and remove or sanitize any records containing HTML or script payloads
Force reset of administrator credentials and invalidate active sessions in case cookies were exfiltrated

Patch Information

BOINC Server through version 1.4.7 is affected. Operators should track fixes in the upstream BOINC repository and apply the release that supersedes 1.4.7. Refer to the Compass Security Advisory CSNC-2025-002 for the affected endpoints that require verification after patching.

Workarounds

Deploy a strict Content Security Policy that disables inline scripts and restricts script sources to trusted origins
Place BOINC Server behind a web application firewall with stored XSS rules covering profile, team, and forum submission endpoints
Restrict administrative interfaces to a separate hostname or VPN so that stored XSS on public pages cannot reach administrator session cookies
Set the HttpOnly and SameSite=Strict flags on session cookies to reduce theft and cross-context abuse

bash

# Example hardening: enforce restrictive CSP and cookie flags at the reverse proxy
# nginx snippet for a BOINC project vhost
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
proxy_cookie_flags ~ HttpOnly Secure SameSite=Strict;