CVE-2025-0972: Zenvia Movidesk XSS Vulnerability

CVE-2025-0972 Overview

CVE-2025-0972 is a stored cross-site scripting (XSS) vulnerability in Zenvia Movidesk versions up to 25.01.22. The flaw exists in the New Ticket Handler component, where the subject argument is improperly sanitized before rendering. Authenticated remote attackers can inject arbitrary JavaScript that executes in the browser context of any user viewing the affected ticket. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation). A public proof-of-concept has been disclosed, and Zenvia has released version 25.01.22.245a473c54 to remediate the issue.

Critical Impact
Attackers with low-privilege accounts can persist malicious scripts in tickets, enabling session hijacking, credential theft, and unauthorized actions against helpdesk agents and administrators.

Affected Products

Zenvia Movidesk versions up to and including 25.01.22
Movidesk New Ticket Handler component
Deployments not upgraded to 25.01.22.245a473c54

Discovery Timeline

2025-02-03 - CVE-2025-0972 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0972

Vulnerability Analysis

The vulnerability resides in the New Ticket Handler of Zenvia Movidesk, a customer service and helpdesk platform. When a user creates a ticket, the subject field accepts input without adequate output encoding or input sanitization. The injected payload is stored server-side and later rendered in agent and administrator dashboards. Because the payload persists in the ticket store, every user who loads the affected ticket executes the attacker-controlled script. Stored XSS in a ticketing workflow is particularly impactful because helpdesk agents routinely interact with untrusted content submitted by end users.

Root Cause

The root cause is missing neutralization of HTML and JavaScript metacharacters in the ticket subject field. Movidesk fails to encode characters such as <, >, and " when persisting or rendering the value. This maps to [CWE-79], Improper Neutralization of Input During Web Page Generation. The absence of a Content Security Policy strict enough to block inline script execution compounds the issue.

Attack Vector

Exploitation requires an authenticated account with permission to create tickets. An attacker submits a new ticket with a JavaScript payload embedded in the subject argument. When a helpdesk agent, supervisor, or administrator opens the ticket queue, the browser parses the stored payload and executes it in the context of the Movidesk application origin. Consequences include theft of session cookies, forced actions on behalf of the victim, exfiltration of ticket contents, and pivoting to other administrative functions. A proof-of-concept document is published on the GitHub PoC repository and referenced in VulDB entry #294363.

// No verified exploit code is republished here.
// See the linked PoC document for technical details.

Detection Methods for CVE-2025-0972

Indicators of Compromise

Ticket subject values containing HTML tags such as <script>, <img onerror=...>, or <svg onload=...>.
Outbound browser requests from authenticated agent sessions to unfamiliar external domains shortly after opening a ticket.
Unexpected session cookie transmissions or new OAuth tokens issued to accounts that did not initiate authentication.

Detection Strategies

Query the ticket database for subject fields containing angle brackets, event handler attributes, or javascript: URI schemes.
Deploy a web application firewall rule that inspects POST requests to the ticket creation endpoint for XSS signatures.
Enable Content Security Policy violation reporting to surface inline script execution in agent consoles.

Monitoring Recommendations

Correlate helpdesk agent browser telemetry with ticket-view events to identify anomalous script execution.
Alert on privileged Movidesk accounts making atypical API calls immediately after loading tickets from low-privilege users.
Review web server access logs for repeated ticket submissions from single accounts containing suspicious payload patterns.

How to Mitigate CVE-2025-0972

Immediate Actions Required

Upgrade Zenvia Movidesk to version 25.01.22.245a473c54 or later.
Audit existing tickets for stored payloads in the subject field and sanitize or remove malicious entries.
Rotate session tokens and credentials for any agent account that viewed suspicious tickets before the patch was applied.

Patch Information

Zenvia has released a fixed build identified as 25.01.22.245a473c54. Administrators should coordinate with Zenvia support to confirm the deployed version and apply the update across all tenants. Refer to VulDB entry #294363 and the VulDB CTI record for authoritative version tracking.

Workarounds

Restrict ticket creation permissions to trusted users until the patch is deployed.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources in the Movidesk interface.
Deploy WAF rules to strip or reject HTML and script metacharacters in the ticket subject parameter.

bash

# Example WAF rule (ModSecurity) to block XSS patterns in ticket subject
SecRule ARGS:subject "@rx (?i)(<script|onerror=|onload=|javascript:)" \
  "id:1000972,phase:2,deny,status:403,msg:'Potential XSS in Movidesk ticket subject (CVE-2025-0972)'"