CVE-2025-11147: Apt-Cacher-NG Reflected XSS Vulnerability

CVE-2025-11147 Overview

CVE-2025-11147 is a reflected cross-site scripting (XSS) vulnerability affecting Apt-Cacher-NG version 3.2.1. The flaw resides in the web interface, where the application renders attacker-controlled input from /html/<filename>.html requests without proper output encoding. An attacker can craft a malicious URL that, when visited by an authenticated administrator or user, executes arbitrary JavaScript in the browser session. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. Apt-Cacher-NG is a caching proxy widely deployed to accelerate Debian and Ubuntu package downloads across enterprise fleets.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed in the context of the victim's browser session against the Apt-Cacher-NG management interface.

Affected Products

Apt-Cacher-NG 3.2.1
Apt-Cacher-NG web management interface (/html/ endpoint)
Deployments serving Debian and Ubuntu package caching on Linux hosts

Discovery Timeline

2025-09-29 - CVE-2025-11147 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11147

Vulnerability Analysis

Apt-Cacher-NG exposes an administrative and status web interface accessible over HTTP. The reflected XSS vulnerability occurs when the server processes requests to /html/<filename>.html and includes user-supplied portions of the URL in the rendered response without proper HTML entity encoding. Because the response is returned immediately to the requester, the attack fits the reflected XSS pattern rather than a stored one.

Exploitation requires user interaction: a target must click or otherwise load a crafted link. Once triggered, the injected script executes with the origin privileges of the Apt-Cacher-NG interface. Attackers can read the DOM, exfiltrate session data, pivot to internal management functions, or serve social-engineering payloads. See the INCIBE Security Notice for the coordinated advisory.

Root Cause

The root cause is missing or incomplete output sanitization in the handler that generates HTML pages under the /html/ path. User-controllable data from the request is concatenated into the response markup without contextual escaping, allowing injected <script> tags or event handlers to be parsed by the browser.

Attack Vector

The attack vector is network-based and requires no privileges on the target server. An attacker crafts a URL containing an XSS payload targeting a vulnerable /html/<filename>.html endpoint and delivers it to a victim through phishing, chat, or a malicious webpage. When the victim's browser loads the URL against a reachable Apt-Cacher-NG instance, the payload reflects into the response and executes.

No verified public proof-of-concept code is available. Refer to the INCIBE advisory for further technical detail.

Detection Methods for CVE-2025-11147

Indicators of Compromise

HTTP GET requests to /html/ paths containing URL-encoded <script>, onerror=, onload=, or javascript: fragments
Web server access logs showing unusually long or malformed filenames appended to /html/ requests
Referrer headers on Apt-Cacher-NG requests originating from external, untrusted domains

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect requests to Apt-Cacher-NG for reflected XSS payload patterns in the URL path and query string
Correlate browser telemetry with Apt-Cacher-NG server logs to identify sessions that loaded suspicious /html/ URLs
Alert on outbound requests from admin workstations to Apt-Cacher-NG hosts immediately followed by anomalous authenticated activity

Monitoring Recommendations

Enable verbose HTTP logging on Apt-Cacher-NG and forward logs to a centralized SIEM for retention and query
Baseline the normal set of filenames requested under /html/ and alert on deviations that include script-like tokens
Monitor for outbound network callbacks from browsers that recently visited an Apt-Cacher-NG interface, indicating potential payload execution

How to Mitigate CVE-2025-11147

Immediate Actions Required

Restrict network access to the Apt-Cacher-NG web interface to trusted administrative subnets using firewall rules or reverse proxy ACLs
Instruct administrators to avoid clicking untrusted links that reference Apt-Cacher-NG hosts until patched
Enforce a strict Content Security Policy (CSP) at any fronting reverse proxy to limit inline script execution

Patch Information

No vendor patch reference is listed in the enriched CVE data at the time of publication. Consult the INCIBE Security Notice and the upstream Apt-Cacher-NG project for the latest fixed release information, and upgrade beyond version 3.2.1 as soon as a corrected build is available.

Workarounds

Bind Apt-Cacher-NG to localhost and access it exclusively via SSH port forwarding until a fixed release is deployed
Place Apt-Cacher-NG behind an authenticating reverse proxy that strips or rejects requests containing script-like characters in the /html/ path
Disable or block external access to the /html/ report endpoints if they are not required for operations

bash

# Example nginx reverse proxy hardening for Apt-Cacher-NG
location /html/ {
    # Block requests containing common XSS payload characters
    if ($request_uri ~* "(<|>|script|onerror|onload|javascript:)") {
        return 403;
    }
    # Restrict to trusted admin network
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://127.0.0.1:3142;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
    add_header X-XSS-Protection "1; mode=block" always;
}