CVE-2025-0667 Overview
CVE-2025-0667 is a stored Cross-Site Scripting (XSS) vulnerability affecting BOINC Server through version 1.4.7. BOINC (Berkeley Open Infrastructure for Network Computing) is a distributed computing platform maintained by the University of California. The vulnerability stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can inject malicious script content that is stored server-side and executed in the browsers of users who later view the affected pages.
Critical Impact
Attackers can hijack authenticated sessions, steal credentials, and perform actions on behalf of BOINC Server administrators through persistent script injection.
Affected Products
- BOINC Server versions up to and including 1.4.7
- University of California BOINC Server distributions
- Web-facing BOINC project deployments hosting user-contributed content
Discovery Timeline
- 2025-05-07 - CVE-2025-0667 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-0667
Vulnerability Analysis
The flaw is a stored XSS issue in the BOINC Server web application. User-supplied input is written to persistent storage and later rendered in HTML responses without adequate encoding or sanitization. When another user, including a privileged administrator, loads the affected page, the injected payload executes in their browser context.
Because the payload is stored, exploitation does not require the victim to click a crafted link. Any user browsing the affected page becomes a target. The Compass Security advisory CSNC-2025-003 documents the issue and provides technical context on the affected input fields.
Root Cause
The root cause is missing or insufficient output encoding when rendering user-controlled data in HTML contexts. Input intended as text is placed directly into HTML without escaping characters such as <, >, and ". This allows attacker-controlled markup and JavaScript to be interpreted by the browser as active content rather than data.
Attack Vector
An unauthenticated attacker submits a payload containing HTML or JavaScript to a vulnerable input field exposed by the BOINC Server web interface. The server stores the payload and later serves it to other users. User interaction, such as visiting the page displaying the stored content, is required to trigger execution. Successful exploitation can lead to session token theft, forced administrative actions, and defacement of project pages.
Refer to the Compass Security Advisory CSNC-2025-003 for the specific injection points and payload details.
Detection Methods for CVE-2025-0667
Indicators of Compromise
- Unexpected HTML tags such as <script>, <img onerror=...>, or <svg onload=...> stored in BOINC Server database tables holding user-submitted content
- Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading BOINC Server pages
- New or modified administrative accounts, forum posts, or project settings without corresponding legitimate activity
Detection Strategies
- Review database records for stored fields containing HTML markup or JavaScript event handlers
- Inspect web server access logs for POST requests carrying encoded script payloads to profile, forum, or team creation endpoints
- Compare rendered HTML output against expected templates to identify injected content
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture violations that indicate injected inline scripts
- Monitor administrator session activity for anomalous requests originating from unusual referrers
- Alert on newly created user profiles containing HTML entities or script-like patterns in text fields
How to Mitigate CVE-2025-0667
Immediate Actions Required
- Upgrade BOINC Server to a version later than 1.4.7 once a fixed release is available from the upstream project
- Audit all user-submitted content stored in the BOINC Server database and remove any entries containing script or HTML payloads
- Invalidate active administrative sessions and rotate credentials for any account that may have viewed injected content
Patch Information
No vendor patch URL is listed in the CVE record at this time. Track the Compass Security Advisory CSNC-2025-003 and the BOINC project repository for updates addressing versions through 1.4.7.
Workarounds
- Deploy a web application firewall (WAF) rule set that blocks HTML tags and JavaScript event handlers in POST bodies submitted to BOINC Server endpoints
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
- Restrict access to the BOINC Server administrative interface to trusted network ranges until a fix is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
