CVE-2025-1085: Animati PACS XSS Vulnerability

CVE-2025-1085 Overview

CVE-2025-1085 is a reflected cross-site scripting (XSS) vulnerability in Animati PACS versions up to 1.24.12.09.03. The flaw resides in the /login endpoint, where the p parameter is not properly sanitized before being reflected in the response. Attackers can craft a malicious URL that executes arbitrary JavaScript in the victim's browser session. The vulnerability is remotely exploitable over the network and requires user interaction to trigger. The exploit details have been publicly disclosed. The vendor was contacted before publication but did not respond, leaving deployments without official remediation guidance.

Critical Impact
Attackers can hijack authenticated PACS sessions, steal credentials, or manipulate the login interface used by clinical staff accessing medical imaging data.

Affected Products

Animati PACS versions up to and including 1.24.12.09.03
The /login endpoint accepting the p parameter
Deployments exposing the PACS web interface to untrusted networks

Discovery Timeline

2025-02-07 - CVE-2025-1085 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1085

Vulnerability Analysis

CVE-2025-1085 is a reflected Cross-Site Scripting (XSS) issue [CWE-79] affecting the login interface of Animati PACS. Picture Archiving and Communication Systems (PACS) are used across healthcare environments to store and distribute medical imaging data. The vulnerable code path accepts the p query parameter on /login and reflects its contents into the rendered HTML without proper output encoding. An attacker can construct a URL containing JavaScript payloads and deliver it to authenticated users via phishing, chat, or embedded links.

When a clinical user clicks the crafted link, the injected script executes within the origin of the PACS application. This grants the attacker access to session cookies, DOM contents, and any client-side authentication tokens. The attacker can also render a fake login form to harvest credentials or pivot to other administrative actions.

Root Cause

The root cause is missing input validation and output encoding on the p parameter processed by the /login handler. User-supplied data is inserted directly into the HTML response context without contextual escaping, violating standard secure output practices for web applications.

Attack Vector

Exploitation requires an attacker to deliver a malicious URL to a target user and convince them to click it while the PACS application is reachable. No authentication is required to craft the payload, but user interaction is required for execution. The attack occurs over the network against the web-facing login page. Because PACS deployments frequently sit behind organizational SSO or share sessions with adjacent clinical portals, script execution in this origin can enable broader account takeover.

The vulnerability manifests when the p parameter contains script-capable characters that reach the response body unescaped. See the VulDB entry for CTIID 294861 for public disclosure details.

Detection Methods for CVE-2025-1085

Indicators of Compromise

HTTP GET requests to /login containing script tags, event handlers (onerror=, onload=), or JavaScript URI schemes in the p parameter
URL-encoded or double-encoded payloads targeting the p parameter, such as %3Cscript%3E sequences
Unusual referrers to /login originating from external email gateways, chat platforms, or shortened URLs
Web server access logs showing repeated /login?p= requests with varying payload structures

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters on /login for XSS signatures
Enable Content Security Policy (CSP) reporting endpoints to capture inline script execution attempts
Correlate reflected parameter values against outbound requests to attacker-controlled domains for exfiltration attempts

Monitoring Recommendations

Log full request URIs for the PACS authentication path and retain them for forensic review
Monitor for anomalous session activity following user clicks on external links to /login
Alert on repeated failed logins immediately after suspicious /login accesses, indicating credential harvesting

How to Mitigate CVE-2025-1085

Immediate Actions Required

Restrict access to the Animati PACS web interface to trusted internal networks or VPN clients only
Deploy a reverse proxy or WAF rule that strips or blocks script-capable characters in the p query parameter on /login
Educate clinical staff to avoid clicking /login links received via email or chat and to access PACS only from bookmarks

Patch Information

No vendor patch is available. According to the public disclosure, the vendor was contacted before disclosure but did not respond. Track vendor communications directly with Animati and monitor the VulDB entry for updates on remediation guidance.

Workarounds

Configure a reverse proxy to reject requests where the p parameter contains <, >, ", ', or javascript: sequences
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to the application origin
Set HttpOnly and SameSite=Strict flags on session cookies to reduce the impact of successful script execution

bash

# Example NGINX rule blocking suspicious payloads on the /login endpoint
location = /login {
    if ($arg_p ~* "(<|>|script|onerror|onload|javascript:)") {
        return 403;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'";
    add_header X-Content-Type-Options "nosniff";
    proxy_pass http://animati_pacs_backend;
}