CVE-2025-22143: Wegia Wegia XSS Vulnerability

CVE-2025-22143 Overview

CVE-2025-22143 is a Reflected Cross-Site Scripting (XSS) vulnerability in WeGIA, an open-source web management application used by charitable institutions. The flaw resides in the listar_permissoes.php endpoint, where the msg_e parameter is reflected into the response without proper sanitization. Attackers can craft a malicious URL that, when opened by an authenticated user, executes arbitrary JavaScript in the victim's browser session. The vulnerability is tracked under [CWE-79] and is fixed in WeGIA version 3.2.8.

Critical Impact
Successful exploitation allows attackers to execute arbitrary scripts in the context of the victim's browser, enabling session theft, credential harvesting, and unauthorized actions within the WeGIA application.

Affected Products

WeGIA versions prior to 3.2.8
listar_permissoes.php endpoint
Deployments maintained by LabRedesCefetRJ

Discovery Timeline

2025-01-08 - CVE-2025-22143 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22143

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw classified under [CWE-79]. The listar_permissoes.php endpoint accepts a user-controlled msg_e query parameter and reflects its value into the HTML response without encoding or sanitization. An attacker crafts a URL containing JavaScript payloads in msg_e and delivers it to a victim through phishing, chat, or embedded links. When the victim visits the link while authenticated to WeGIA, the injected script executes in the browser under the application's origin.

Because the payload runs with the victim's session context, attackers can steal cookies, hijack sessions, perform actions on behalf of the user, or pivot to further attacks against the charitable institution's data. User interaction is required to trigger the exploit, but no privileges or prior authentication are required by the attacker.

Root Cause

The root cause is missing output encoding on the msg_e parameter before it is rendered in the HTML response. WeGIA does not apply context-aware escaping (such as htmlspecialchars in PHP) to user-supplied input before inclusion in server-generated markup.

Attack Vector

Exploitation occurs over the network via a specially crafted URL targeting listar_permissoes.php. The attacker delivers the URL to a WeGIA user, who must click or open it. Once loaded, the reflected payload executes in the victim's browser. See the GitHub Security Advisory GHSA-gxh2-8jxp-m59h for additional technical detail.

Detection Methods for CVE-2025-22143

Indicators of Compromise

Web server access logs showing requests to listar_permissoes.php containing suspicious characters in the msg_e parameter, such as <script>, javascript:, onerror=, or URL-encoded equivalents like %3Cscript%3E.
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after visiting WeGIA URLs.
Session anomalies, including logins from unusual geolocations or user agents following a phishing campaign referencing WeGIA links.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule to inspect and block requests to listar_permissoes.php where msg_e contains HTML or script metacharacters.
Enable and review WeGIA HTTP access logs for reflected payload patterns and repeated requests from single sources.
Correlate URL referrers in browser telemetry with known phishing infrastructure to identify targeted delivery attempts.

Monitoring Recommendations

Monitor authentication events for suspicious session activity following user clicks on external WeGIA links.
Track Content Security Policy (CSP) violation reports if CSP headers are configured on the WeGIA host.
Alert on repeated 4xx and 5xx responses from listar_permissoes.php, which may indicate payload probing.

How to Mitigate CVE-2025-22143

Immediate Actions Required

Upgrade WeGIA to version 3.2.8 or later, which contains the official fix for the msg_e reflection issue.
Review the GitHub Security Advisory GHSA-gxh2-8jxp-m59h for vendor guidance.
Notify WeGIA users to avoid clicking untrusted links referencing the application until patching is complete.

Patch Information

The vendor released a fix in WeGIA 3.2.8. Administrators should update immediately by pulling the latest release from the LabRedesCefetRJ/WeGIA repository and redeploying the application.

Workarounds

Restrict access to listar_permissoes.php at the reverse proxy or WAF layer until the patch is applied.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and untrusted script sources to reduce XSS impact.
Configure the HttpOnly and Secure flags on session cookies to limit script access to session identifiers.

bash

# Configuration example: sample WAF rule blocking script metacharacters in msg_e
SecRule ARGS:msg_e "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1002201,phase:2,deny,status:403,\
    msg:'Potential XSS in WeGIA listar_permissoes.php msg_e parameter'"