CVE-2025-24885: pwn.college Stored XSS Vulnerability

CVE-2025-24885 Overview

CVE-2025-24885 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in pwn.college, an education platform for hands-on cybersecurity training. The flaw stems from missing access control on the rendering of custom unprivileged dojo pages. Authenticated users can inject persistent JavaScript payloads that execute in the browsers of other users who view the affected dojo pages. The vulnerability enables session theft, account takeover, and unauthorized actions performed in the context of victim users. The issue is tracked in the pwn.college dojo repository on GitHub under advisory GHSA-8m79-rmhw-rg84.

Critical Impact
Authenticated attackers can inject stored XSS payloads into custom dojo pages, executing arbitrary JavaScript in victim browsers and compromising session integrity across the platform.

Affected Products

pwn.college dojo platform (pwncollege/dojo)
Self-hosted dojo deployments rendering custom unprivileged pages
Instances prior to the patched commit referenced in advisory GHSA-8m79-rmhw-rg84

Discovery Timeline

2025-01-30 - CVE-2025-24885 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24885

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the dojo page rendering pipeline. The platform allows users to create custom dojo pages but does not enforce sufficient access control or output sanitization when rendering unprivileged content. An attacker with a low-privileged account can author a dojo page containing malicious HTML or JavaScript. When another user, including instructors or administrators, visits the crafted page, the payload executes in their browser context.

Because exploitation requires only low privileges and user interaction with a malicious page, attackers can chain this flaw with social engineering to broaden reach. The scope change indicated in the CVSS vector reflects that injected scripts run beyond the boundary of the attacker's own account, affecting other users on the platform.

Root Cause

The root cause is missing access control combined with insufficient output encoding when rendering custom dojo content. User-supplied page content is rendered without restricting which users may publish such pages or sanitizing HTML constructs that lead to script execution. This pattern aligns with CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

An attacker registers or uses an existing low-privileged account on a vulnerable dojo instance. The attacker creates a custom dojo page containing a JavaScript payload embedded in unsanitized fields. The attacker then distributes the page link to victims or relies on platform navigation. When a victim renders the page, the script executes with the victim's session, enabling cookie theft, CSRF-style actions, and credential harvesting via injected forms. See the pwn.college Security Advisory GHSA-8m79-rmhw-rg84 for technical specifics.

Detection Methods for CVE-2025-24885

Indicators of Compromise

Dojo page content containing <script> tags, javascript: URIs, or event handler attributes such as onerror, onload, or onmouseover
Outbound requests from user browsers to attacker-controlled domains after viewing dojo pages
Unexpected session token transmissions in web server access logs to external hosts
Newly created custom dojo pages from low-reputation or recently registered accounts

Detection Strategies

Audit the dojo database for stored page content containing HTML script constructs or encoded JavaScript payloads
Deploy a Content Security Policy (CSP) reporting endpoint to capture script execution violations on dojo page renders
Review web application firewall (WAF) logs for POST requests to dojo page creation endpoints containing XSS signatures
Correlate page creation events with subsequent anomalous authentication or privilege actions performed by viewers

Monitoring Recommendations

Monitor application logs for dojo page creation and modification events, tracking authoring user, timestamp, and content size
Track outbound HTTP requests from dojo infrastructure for unusual referrer patterns indicating exfiltration
Alert on administrator or instructor accounts visiting newly created user-authored dojo pages

How to Mitigate CVE-2025-24885

Immediate Actions Required

Update self-hosted dojo deployments to the patched version referenced in advisory GHSA-8m79-rmhw-rg84
Audit existing custom dojo pages for malicious HTML or JavaScript and remove offending content
Invalidate active sessions for users who may have viewed compromised pages and force re-authentication
Restrict custom dojo page creation to vetted users until the patch is applied

Patch Information

The maintainers of pwn.college published advisory GHSA-8m79-rmhw-rg84 with remediation guidance. Apply the fix from the pwn.college dojo GitHub Security Advisory by pulling the latest patched release of the dojo container or repository and redeploying the platform.

Workarounds

Disable the custom dojo page feature for unprivileged users via platform configuration until patching is complete
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Apply server-side HTML sanitization on all user-submitted dojo page content using an allowlist-based library

bash

# Example restrictive Content-Security-Policy header for dojo deployments
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";