CVE-2025-0971: Zenvia Movidesk XSS Vulnerability

CVE-2025-0971 Overview

CVE-2025-0971 is a cross-site scripting (XSS) vulnerability in Zenvia Movidesk versions up to 25.01.22. The flaw resides in the Profile Editing component, specifically in the /Account/EditProfile endpoint. Attackers can manipulate the username argument to inject malicious script content. The vulnerability requires low privileges and can be exploited remotely over the network without user interaction. Public disclosure of the exploit details has occurred, increasing the risk of opportunistic exploitation. Zenvia addressed the issue in version 25.01.22.245a473c54.

Critical Impact
Authenticated attackers can inject arbitrary JavaScript into the Movidesk profile editing workflow, enabling session theft, credential harvesting, or targeted phishing against help desk users.

Affected Products

Zenvia Movidesk versions up to and including 25.01.22
Movidesk Profile Editing component (/Account/EditProfile)
Deployments running the vulnerable username parameter handler

Discovery Timeline

2025-02-03 - CVE-2025-0971 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0971

Vulnerability Analysis

The vulnerability is classified as cross-site scripting under [CWE-79]. It affects the Profile Editing feature of the Movidesk help desk platform. An authenticated attacker submits crafted input through the username field in /Account/EditProfile. The application fails to sanitize or encode the submitted value before rendering it in subsequent responses. When a victim loads a page that reflects or stores this value, the browser executes the injected script in the context of the Movidesk origin.

Movidesk is a customer service and ticketing platform. Exploitation can expose agent sessions, customer data visible to agents, and administrative interfaces reachable from the compromised session.

Root Cause

The root cause is improper neutralization of user-supplied input during web page generation. The username parameter accepts HTML and JavaScript characters without output encoding or input filtering. The vulnerable code path renders the stored or reflected value directly into the HTML response.

Attack Vector

The attack vector is network-based and requires low privileges, meaning the attacker needs an authenticated Movidesk account. The attacker submits a crafted payload to the /Account/EditProfile endpoint by modifying the username parameter. Once stored, the payload executes whenever an administrator, agent, or other user views the attacker-controlled profile.

No verified proof-of-concept code is available in public exploit databases. See the VulDB entry for this vulnerability for additional technical context.

Detection Methods for CVE-2025-0971

Indicators of Compromise

Unexpected HTML tags or JavaScript sequences stored in Movidesk user username fields
Outbound requests from agent browsers to unfamiliar domains shortly after loading profile or ticket pages
Account activity from Movidesk sessions originating in unusual geolocations following profile views

Detection Strategies

Inspect HTTP POST requests to /Account/EditProfile for payloads containing <script>, onerror=, javascript:, or encoded script fragments in the username parameter
Audit the Movidesk user directory for profile names containing HTML control characters or non-printable sequences
Correlate browser process behavior on agent workstations with Movidesk session activity to identify script-triggered requests

Monitoring Recommendations

Enable web application firewall (WAF) logging for the /Account/EditProfile endpoint and alert on reflected XSS signatures
Monitor Movidesk administrative action logs for privilege changes initiated shortly after profile views
Track authentication anomalies tied to accounts that recently rendered modified profiles

How to Mitigate CVE-2025-0971

Immediate Actions Required

Upgrade Zenvia Movidesk to version 25.01.22.245a473c54 or later
Review all existing user profiles for malicious content in the username field and sanitize affected records
Force password resets and invalidate active sessions for any accounts suspected of exploitation
Restrict account creation and profile editing to trusted users until the patch is applied

Patch Information

Zenvia released a fix in version 25.01.22.245a473c54. Administrators should coordinate with Zenvia support to confirm the upgrade path for their deployment. Verify the patch applies output encoding to the username field across all rendered views.

Workarounds

Deploy a WAF rule to block requests to /Account/EditProfile containing <, >, or script keywords in the username parameter
Enforce a strict Content Security Policy (CSP) that blocks inline scripts and restricts script sources on Movidesk origins
Limit profile editing permissions to a reduced set of trusted administrative users until the upgrade is deployed

bash

# Example WAF rule (ModSecurity) to block script payloads in the username parameter
SecRule ARGS:username "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1009710,phase:2,deny,status:403,log,\
    msg:'CVE-2025-0971 XSS attempt in Movidesk EditProfile username'"