CVE-2025-11360: Jakowenko Double-Take XSS Vulnerability

CVE-2025-11360 Overview

CVE-2025-11360 is a cross-site scripting (XSS) vulnerability in the jakowenko double-take application through version 1.13.1. The flaw resides in the app.use function inside api/src/app.js, where the X-Ingress-Path HTTP header is inserted into an inline <script> block without proper serialization. An attacker who can influence this header value can inject JavaScript that executes in the context of the served HTML page. The issue is classified as CWE-79 and is remotely reachable, though it requires user interaction to trigger. Upgrading to version 1.13.2 resolves the flaw via commit e11de9dd6b4ea6b7ec9a5607a920d48961e9fa50.

Critical Impact

Attacker-controlled X-Ingress-Path header values are reflected into a client-side script tag, enabling arbitrary JavaScript execution in the victim's browser session.

Affected Products

• jakowenko double-take versions up to and including 1.13.1
• Component: api/src/app.js (API service)
• Fixed in: double-take version 1.13.2

Discovery Timeline

• 2025-10-07 - CVE-2025-11360 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11360

Vulnerability Analysis

The double-take API serves the frontend index.html file and injects two runtime values into an inline <script> block: window.ingressUrl and window.publicPath. The ingressUrl value is sourced directly from the incoming X-Ingress-Path request header. Before the patch, the value was concatenated into JavaScript source using single-quote string literals without escaping. An attacker who can set this header on a request whose response is rendered in a browser can break out of the string literal and execute arbitrary JavaScript.

The injected script executes in the same origin as the double-take web interface. Because the flaw executes on the client, exploitation can lead to session token theft, DOM manipulation, or pivoting to other browser-accessible resources.

Root Cause

The root cause is unsafe string interpolation of untrusted input into an HTML <script> context. The original code embedded the raw header value inside a single-quoted JavaScript string, which is trivially escaped by including a single quote followed by attacker JavaScript. No output encoding, allowlist validation, or serialization was applied to the header before it entered the response body.

Attack Vector

Exploitation requires the victim to load the vulnerable HTML endpoint with an attacker-influenced X-Ingress-Path header. This typically occurs when double-take is deployed behind an ingress proxy (such as the Home Assistant ingress) that forwards this header, or when an attacker can trick a proxy or client into sending the crafted header. The user interaction requirement (UI:P in the CVSS vector) reflects that a victim must visit the affected page for the payload to execute.

     `${process.cwd()}/frontend/${process.env.NODE_ENV === 'production' ? '' : 'dist/'}index.html`,
     'utf8'
   );
+  // Safely serialize values to prevent XSS
+  const ingressUrlSafe = JSON.stringify(req.headers['x-ingress-path'] || '');
+  const publicPathSafe = JSON.stringify(UI?.PATH || '');
   res.send(
     html.replace(
       '</head>',
       `<script>
-        window.ingressUrl = '${req.headers['x-ingress-path'] || ''}';
-        window.publicPath = '${UI?.PATH || ''}';
+        window.ingressUrl = ${ingressUrlSafe};
+        window.publicPath = ${publicPathSafe};
       </script>
       </head>`
     )

Source: GitHub Commit e11de9d. The patch wraps both values in JSON.stringify(), which produces a safely quoted and escaped JavaScript string literal.

Detection Methods for CVE-2025-11360

Indicators of Compromise

• HTTP requests to the double-take API containing X-Ingress-Path header values with characters such as ', <, >, or JavaScript keywords like alert(, fetch(, or document.cookie.
• Server-rendered HTML responses from double-take where the inline <script> block contains unbalanced quotes or unexpected function calls.
• Outbound browser requests to unfamiliar domains originating from users viewing the double-take interface.

Detection Strategies

• Inspect reverse proxy and ingress access logs for anomalous X-Ingress-Path header values submitted by external clients.
• Deploy a Content Security Policy (CSP) report-only rule to surface inline script violations on the double-take frontend origin.
• Run version fingerprinting against internal double-take deployments to identify instances at or below version 1.13.1.

Monitoring Recommendations

• Alert on any HTTP request to the double-take API containing metacharacters in the X-Ingress-Path header.
• Correlate frontend JavaScript error telemetry with recent HTTP requests to detect exploitation attempts that trigger script parsing failures.
• Monitor GitHub for new advisories on the jakowenko/double-take repository to catch related follow-up fixes.

How to Mitigate CVE-2025-11360

Immediate Actions Required

• Upgrade double-take to version 1.13.2 or later, which contains commit e11de9dd6b4ea6b7ec9a5607a920d48961e9fa50.
• Restrict network exposure of the double-take API to trusted networks until the upgrade is applied.
• Audit any reverse proxy configuration to ensure the X-Ingress-Path header cannot be supplied by untrusted upstream clients.

Patch Information

The fix is available in GitHub Release v1.13.2. The patch modifies api/src/app.js to apply JSON.stringify() to both req.headers['x-ingress-path'] and UI?.PATH before interpolating them into the inline <script> block, ensuring the values are emitted as safely quoted JavaScript string literals rather than raw source.

Workarounds

• Strip or overwrite the X-Ingress-Path header at the reverse proxy or ingress layer for requests originating from untrusted clients.
• Apply a strict Content Security Policy that forbids inline script execution, breaking the exploitation path while a patch is scheduled.
• Place the double-take UI behind authentication and network segmentation so only trusted users can reach the vulnerable endpoint.

# Example NGINX snippet to clear an attacker-controlled X-Ingress-Path header
location / {
    proxy_set_header X-Ingress-Path "";
    proxy_pass http://double-take-backend;
}