CVE-2025-24833: desknet's NEO Stored XSS Vulnerability

CVE-2025-24833 Overview

CVE-2025-24833 is a stored cross-site scripting (XSS) vulnerability affecting desknet's NEO, a Japanese groupware platform developed by NEOJAPAN Inc. The flaw allows an authenticated attacker to inject persistent JavaScript payloads that execute in the browsers of other users who view the affected content. Successful exploitation requires user interaction, but the stored nature of the payload means every visitor to the compromised page becomes a potential victim. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers with low-privilege access can plant persistent JavaScript that runs in other users' sessions, enabling session theft, credential harvesting, and unauthorized actions within the desknet's NEO groupware environment.

Affected Products

desknet's NEO V4.0R1.0 through V9.0R2.0
NEOJAPAN groupware deployments across the affected version range
On-premises installations of desknet's NEO within the vulnerable version window

Discovery Timeline

2025-10-16 - CVE-2025-24833 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24833

Vulnerability Analysis

The vulnerability resides in input handling routines within desknet's NEO that fail to neutralize HTML and JavaScript control characters before rendering user-supplied content. An authenticated user with low privileges can submit crafted input containing script payloads through affected fields. When another user opens the affected view, the browser parses and executes the injected script in the context of the victim's session.

Because the payload is stored server-side, exploitation does not require the attacker to trick the victim into clicking a malicious link. Any legitimate navigation to the affected resource triggers execution. This makes the flaw suitable for targeting internal users, including administrators, in shared groupware workflows.

The impact is limited to confidentiality and integrity effects at the browser level, but in a groupware context this can extend to reading messages, exfiltrating documents, or issuing requests on behalf of the victim.

Root Cause

The root cause is missing or insufficient output encoding of user-controlled data rendered into HTML responses. The application accepts input containing angle brackets, quotes, and script tags and stores it without contextual sanitization. When the data is rendered, the browser treats it as executable markup rather than inert text, satisfying the conditions for CWE-79.

Attack Vector

Exploitation proceeds over the network against the desknet's NEO web interface. The attacker authenticates with valid low-privilege credentials and submits a payload into a persistent field rendered to other users. A victim triggers execution by viewing the affected page, at which point the injected JavaScript runs under the victim's session origin. See the JVN vulnerability report for the coordinated disclosure summary.

No verified public exploit code is available for this vulnerability. Refer to the vendor and JVN advisories for technical scope.

Detection Methods for CVE-2025-24833

Indicators of Compromise

Stored content in desknet's NEO fields containing <script>, onerror=, onload=, or javascript: tokens
Unexpected outbound HTTP requests from user browsers to attacker-controlled domains shortly after loading desknet's NEO pages
Session cookie access or DOM modifications observed in browser telemetry when viewing groupware content
Anomalous authenticated API calls originating from user sessions without corresponding user interaction

Detection Strategies

Inspect the desknet's NEO database and stored records for HTML control characters and script fragments in text fields
Enable and review web application firewall (WAF) logs for injection patterns targeting the groupware endpoints
Correlate browser telemetry with groupware access logs to identify script execution tied to specific stored records
Hunt across proxy and DNS logs for suspicious outbound connections initiated during desknet's NEO sessions

Monitoring Recommendations

Forward desknet's NEO web server access logs to a central analytics platform for query and correlation
Alert on Content Security Policy (CSP) violation reports from browsers accessing the groupware application
Track authentication events and session activity for accounts exhibiting unusual posting or content modification patterns
Monitor administrator account activity closely, since XSS payloads targeting admins yield the highest impact

How to Mitigate CVE-2025-24833

Immediate Actions Required

Apply the fixed version of desknet's NEO as documented in the vendor maintenance guide
Audit stored records created during the exposure window for injected scripts and remove or sanitize affected entries
Rotate session tokens and require re-authentication for users who may have viewed compromised content
Restrict low-privilege account creation and review recent account provisioning events

Patch Information

NEOJAPAN has published maintenance information for desknet's NEO addressing this issue. Administrators should consult the Desknets Maintenance Guide for the specific fixed release corresponding to their deployed version and follow the vendor's upgrade procedure. Confirm patch application by verifying the installed build against the vendor's advisory.

Workarounds

Deploy a WAF rule set that blocks HTML and JavaScript control characters in requests to the affected desknet's NEO endpoints
Enforce a strict Content Security Policy that disallows inline scripts on the groupware origin
Limit access to the desknet's NEO web interface to trusted network segments while patching is scheduled
Reduce the number of accounts with content-authoring privileges to shrink the pool of potential injectors

bash

# Example restrictive Content-Security-Policy header for the groupware origin
# Adjust script-src to match vendor-provided static assets before deployment
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report";