CVE-2025-2086: StarSea99 Starsea-mall XSS Vulnerability

CVE-2025-2086 Overview

CVE-2025-2086 is a reflected cross-site scripting (XSS) vulnerability in StarSea99 starsea-mall 1.0.0. The flaw exists in the /admin/indexConfigs/update endpoint, where the redirectUrl parameter is not properly sanitized before being rendered in the response. Attackers can inject arbitrary JavaScript that executes in the context of an authenticated administrator's browser session. The vulnerability is remotely exploitable and requires user interaction combined with low-privileged access. Public disclosure of the exploit details increases the likelihood of opportunistic abuse against exposed deployments.

Critical Impact
Authenticated attackers can execute arbitrary script in an administrator's browser, enabling session theft, credential capture, and unauthorized administrative actions within the starsea-mall backend.

Affected Products

StarSea99 starsea-mall 1.0.0
Component: /admin/indexConfigs/update handler
Parameter: redirectUrl

Discovery Timeline

2025-03-07 - CVE-2025-2086 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2086

Vulnerability Analysis

The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. The /admin/indexConfigs/update endpoint accepts a redirectUrl argument from client-supplied input. The application reflects this value into HTML output without applying context-appropriate encoding or filtering. As a result, an attacker who supplies a crafted payload containing HTML or JavaScript can cause that script to execute in any browser that renders the response.

Exploitation requires an authenticated session with at least low-privileged access to the admin interface, and a target user must interact with the malicious request or link. Because starsea-mall is an e-commerce platform, successful exploitation against a store administrator can compromise product configuration, customer data flows, and other privileged operations.

Root Cause

The root cause is missing output encoding of the redirectUrl parameter during response rendering. The application trusts client-supplied redirect targets and echoes them back to the browser in a script-executable context. There is no allowlist of valid redirect destinations and no HTML entity encoding applied before reflection.

Attack Vector

An attacker with low-privileged administrative credentials, or one who convinces an authenticated administrator to visit a crafted URL, sends a request to /admin/indexConfigs/update containing a malicious payload in the redirectUrl parameter. When the response is rendered, the injected script executes in the browser under the origin of the starsea-mall admin panel. See the GitHub Security Documentation and VulDB entry 298900 for the disclosed proof-of-concept details.

No verified code example is available. Refer to the linked public disclosure for the exact payload format.

Detection Methods for CVE-2025-2086

Indicators of Compromise

HTTP requests to /admin/indexConfigs/update containing <script>, javascript:, onerror=, or URL-encoded variants within the redirectUrl parameter.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after admin panel interaction.
Admin session cookies appearing in referer headers or query strings to external hosts.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the redirectUrl parameter for HTML tags, JavaScript URI schemes, and event-handler attributes.
Log and alert on all POST or GET requests to /admin/indexConfigs/update that contain reserved characters such as <, >, ", or ' in query or body parameters.
Correlate administrator authentication events with subsequent anomalous JavaScript execution patterns in browser telemetry.

Monitoring Recommendations

Enable verbose access logging on the starsea-mall admin routes and forward events to a centralized SIEM for retention and correlation.
Baseline normal redirectUrl values used by legitimate administrators to identify deviations quickly.
Monitor for administrator account activity originating from unusual IP addresses or user agents following suspected XSS delivery.

How to Mitigate CVE-2025-2086

Immediate Actions Required

Restrict network access to the starsea-mall admin interface using IP allowlisting or VPN gating until a fix is available.
Rotate administrator credentials and invalidate active sessions if suspicious requests to /admin/indexConfigs/update are observed.
Enforce short session lifetimes and require re-authentication for sensitive admin actions.

Patch Information

No vendor advisory or official patch has been published for starsea-mall 1.0.0 at the time of this writing. Organizations running this application should treat the deployment as unpatched and apply compensating controls. Review the VulDB CTI record and the VulDB submission for updates on remediation status.

Workarounds

Add a reverse-proxy filter that strips or rejects redirectUrl values containing HTML control characters or non-allowlisted URL schemes.
Configure a strict Content Security Policy (CSP) on admin responses to block inline script execution and unauthorized script sources.
Set HttpOnly and Secure flags on administrative session cookies to reduce the impact of successful script injection.

bash

# Example NGINX configuration to block suspicious redirectUrl payloads
location /admin/indexConfigs/update {
    if ($arg_redirectUrl ~* "(<|>|script|javascript:|onerror=|onload=)") {
        return 403;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'";
    add_header X-XSS-Protection "1; mode=block";
    proxy_pass http://starsea_mall_backend;
}