CVE-2025-2085: Starsea99 Starsea-mall XSS Vulnerability

CVE-2025-2085 Overview

CVE-2025-2085 is a cross-site scripting (XSS) vulnerability in StarSea99 starsea-mall version 1.0.0. The flaw resides in the /admin/carousels/save endpoint, where the redirectUrl parameter is not properly sanitized before being reflected to users. An authenticated attacker can inject arbitrary script content that executes in the browser context of any user viewing the affected page. The exploit has been publicly disclosed, increasing the likelihood of opportunistic exploitation against exposed administrative interfaces. The weakness is tracked as CWE-79 — Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of the starsea-mall administrative interface, enabling session theft, admin action forgery, and content tampering.

Affected Products

StarSea99 starsea-mall 1.0.0
Administrative endpoint /admin/carousels/save
Deployments exposing the admin panel to untrusted networks

Discovery Timeline

2025-03-07 - CVE-2025-2085 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2085

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the carousel management feature of starsea-mall. The redirectUrl argument submitted to /admin/carousels/save is stored or reflected without adequate output encoding. When the value is rendered back to the browser, embedded HTML or JavaScript executes within the same-origin context of the admin console.

Exploitation requires low privileges and user interaction, aligning with the CVSS vector components PR:L and UI:P. An attacker with a low-privileged account can craft a malicious link or form submission targeting an admin user. Successful execution allows the attacker to read authenticated session data, invoke administrative APIs, or manipulate storefront carousel content.

Because starsea-mall is an e-commerce platform, injected scripts running with admin privileges can pivot to customer-facing pages, enabling downstream attacks against shoppers such as credential harvesting or payment page tampering.

Root Cause

The root cause is missing input validation and output encoding on the redirectUrl parameter. The application accepts arbitrary characters, including HTML control characters and JavaScript URI schemes, and emits them into HTML contexts without contextual escaping. This maps directly to CWE-79.

Attack Vector

The attack is delivered over the network against the administrative interface. An attacker crafts a request to /admin/carousels/save with a malicious payload in the redirectUrl field. Delivery typically involves social engineering the admin user into clicking a prepared link or visiting an attacker-controlled page that triggers the request. When the response is rendered, the injected script executes with the privileges of the victim's session. Technical details are published in the GitHub security document and the VulDB entry.

Detection Methods for CVE-2025-2085

Indicators of Compromise

HTTP POST or GET requests to /admin/carousels/save containing <script>, javascript:, onerror=, or encoded variants in the redirectUrl parameter.
Outbound requests from admin browser sessions to unfamiliar domains shortly after visiting the carousel management page.
Modified carousel records referencing attacker-controlled URLs or non-standard schemes.

Detection Strategies

Inspect web server and application logs for redirectUrl values that include HTML tags, event handlers, or URL-encoded script payloads.
Deploy web application firewall (WAF) rules matching common XSS payload patterns targeting the /admin/carousels/* path.
Correlate admin session activity with unexpected DOM events or cross-origin requests using browser telemetry where available.

Monitoring Recommendations

Alert on any anomalous administrative account activity following carousel edits, especially privilege changes or data exports.
Monitor for repeated failed input validation events on /admin/carousels/save.
Track referrer patterns and geolocation anomalies for admin logins that precede carousel modifications.

How to Mitigate CVE-2025-2085

Immediate Actions Required

Restrict access to the /admin/* interface to trusted networks or via VPN until a patched build is deployed.
Enforce least-privilege on administrative accounts and require multi-factor authentication for admin logins.
Review recent carousel entries and remove any records containing suspicious redirectUrl values.

Patch Information

No vendor advisory or official patch has been referenced in the CVE record. Consult the upstream StarSea99 starsea-mall repository and the VulDB submission for updates. Until an official fix is available, apply the compensating controls in the workarounds section.

Workarounds

Implement server-side validation on redirectUrl to allow only well-formed HTTP/HTTPS URLs matching an approved domain list.
Apply contextual HTML output encoding wherever redirectUrl is rendered, using framework-provided encoders rather than manual replacements.
Deploy a strict Content Security Policy (CSP) that disallows inline scripts and untrusted script sources on admin pages.
Add WAF signatures blocking <, >, javascript:, and common event-handler substrings in the redirectUrl parameter.

bash

# Example nginx rule to block obvious XSS payloads on the affected endpoint
location = /admin/carousels/save {
    if ($args ~* "(<script|javascript:|onerror=|onload=)") {
        return 403;
    }
    proxy_pass http://starsea_mall_backend;
}