CVE-2025-2130: OpenXE Ticket System XSS Vulnerability

CVE-2025-2130 Overview

CVE-2025-2130 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in OpenXE versions up to and including 1.12. The flaw resides in the Ticket Bearbeiten (ticket editing) page, where the Notizen (notes) parameter is not properly sanitized before being rendered in the browser. An authenticated remote attacker can inject arbitrary JavaScript that executes in the context of any user who subsequently views the affected ticket. Public proof-of-concept exploit code has been published, increasing the risk of opportunistic abuse against exposed OpenXE deployments. The vendor was contacted prior to disclosure but did not respond.

Critical Impact
Authenticated attackers can inject persistent JavaScript into OpenXE tickets, enabling session hijacking, credential theft, or unauthorized actions performed in the context of other authenticated users.

Affected Products

OpenXE versions up to and including 1.12
Component: Ticket Bearbeiten (ticket editing) page
Vulnerable parameter: Notizen

Discovery Timeline

2025-03-09 - CVE-2025-2130 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2130

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the OpenXE enterprise resource planning (ERP) application. The Ticket Bearbeiten page accepts user-supplied content through the Notizen field without adequate output encoding or input sanitization. When any authenticated user opens a ticket containing the crafted payload, the browser interprets the injected markup as executable JavaScript.

Because the payload is stored in the application's ticket data, exploitation does not require the victim to click a specially crafted URL. Any subsequent view of the affected ticket triggers execution. Attackers can leverage the injected script to steal session cookies, perform ticket modifications on behalf of the victim, or pivot to other application features accessible to the compromised session.

The attack requires low privileges (an account able to edit tickets) and some user interaction (a victim viewing the ticket). The impact is limited to the confidentiality and integrity of data reachable within the browser session, not the underlying server.

Root Cause

The root cause is missing or insufficient output encoding of user-controlled data when the OpenXE ticket editing view renders the Notizen field. HTML control characters submitted by an attacker are echoed back verbatim, allowing <script> tags and event-handler attributes to reach the DOM.

Attack Vector

An authenticated attacker submits a ticket note containing a JavaScript payload through the Ticket Bearbeiten page. The payload persists in the OpenXE backend. When another user opens the ticket, the malicious script executes in that user's browser under the OpenXE origin. Public exploit details are available in the GitHub PoC Repository and the Singto PoC for OpenXE XSS.

No verified sanitized exploit code is reproduced here. Refer to the linked proof-of-concept references for technical payload details.

Detection Methods for CVE-2025-2130

Indicators of Compromise

Ticket Notizen fields containing HTML tags such as <script>, <img onerror=...>, <svg onload=...>, or javascript: URIs
Outbound HTTP requests from user browsers to unfamiliar domains immediately after opening an OpenXE ticket
Unexpected session token or cookie transmissions originating from OpenXE pages
Unusual ticket modifications performed by accounts that did not initiate the change

Detection Strategies

Review OpenXE database records for ticket note fields containing HTML or JavaScript syntax
Enable and inspect web server access logs for POST requests to the ticket editing endpoint carrying suspicious payloads in the Notizen parameter
Deploy a web application firewall (WAF) rule set that flags XSS patterns targeting the ticket editing endpoint
Correlate ticket edit events with abnormal follow-on activity from viewing users

Monitoring Recommendations

Forward OpenXE application and web server logs to a centralized logging platform for retention and query
Alert on any HTTP responses that reflect unescaped <, >, or on* event handlers within ticket detail pages
Monitor for anomalous browser-originated requests following ticket views, which may indicate cookie exfiltration
Track privileged user accounts for signs of session takeover, including new IPs, user agents, or geolocations

How to Mitigate CVE-2025-2130

Immediate Actions Required

Restrict access to the OpenXE instance to trusted networks or via VPN until a fix is available
Audit existing tickets for stored payloads in the Notizen field and sanitize or purge any suspicious entries
Limit ticket editing privileges to the minimum set of users required for business operations
Enforce strong session management, including short session lifetimes and HttpOnly cookies, to reduce impact of script execution

Patch Information

At the time of publication, no vendor patch has been released. The vendor did not respond to the disclosure attempt. Organizations should monitor the OpenXE project references and vendor channels for updates and apply any released fix promptly. In the interim, apply the workarounds below.

Workarounds

Deploy a WAF rule that blocks or strips HTML tags and JavaScript event handlers submitted to the ticket editing endpoint
Configure a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins
Set the HttpOnly and Secure attributes on session cookies to prevent script-based theft
Educate ticket users to report unexpected browser behavior when viewing tickets and to avoid opening tickets from untrusted submitters

bash

# Example nginx snippet: add security headers for the OpenXE application
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;