CVE-2025-24967: Yogeshojha Rengine XSS Vulnerability

CVE-2025-24967 Overview

CVE-2025-24967 is a stored cross-site scripting (XSS) vulnerability in reNgine, an automated reconnaissance framework for web applications. The flaw resides in the admin panel's user management functionality. An attacker with privileged access can inject malicious JavaScript payloads into the username field during user creation. The payload executes whenever an administrator views or interacts with the affected user entry. All versions up to and including 2.20 are affected. The vulnerability is tracked under CWE-79 and documented in GitHub Security Advisory GHSA-23wx-5q5w-334w.

Critical Impact
Successful exploitation allows arbitrary script execution in the administrator's browser session, enabling hijacking of sensitive admin functionalities within reNgine.

Affected Products

reNgine versions through 2.20
yogeshojha/rengine reconnaissance framework
All deployments exposing the admin panel to attacker-controlled user creation

Discovery Timeline

2025-02-04 - CVE-2025-24967 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24967

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the user management workflow of the reNgine admin panel. The application fails to sanitize or encode input submitted in the username field during user creation. Supplied input is persisted to the backend data store and later rendered in administrative views without proper output encoding. When an administrator loads a page containing the attacker-controlled username, the browser executes the injected script in the admin's authenticated session context. This permits actions such as session token theft, CSRF-style request forgery against admin endpoints, and manipulation of reconnaissance data.

Root Cause

The root cause is improper neutralization of input during web page generation ([CWE-79]). reNgine stores untrusted username input verbatim and emits it into HTML contexts without encoding. The absence of a Content Security Policy restricting inline script execution amplifies the impact.

Attack Vector

Exploitation requires an attacker who can submit input to the user creation workflow. The attacker injects a JavaScript payload into the username field. The payload persists and triggers whenever an administrator views the user listing or interacts with the entry. The attack vector is network-based and does not require user interaction from the victim beyond navigating to the affected admin page. See the reNgine security advisory for additional technical details.

Detection Methods for CVE-2025-24967

Indicators of Compromise

User accounts in reNgine with usernames containing HTML tags, <script> elements, or JavaScript event handlers such as onerror= or onload=.
Unexpected outbound HTTP requests originating from administrator browser sessions after viewing the user management page.
Admin session cookies or CSRF tokens appearing in web server logs for untrusted destinations.

Detection Strategies

Review the reNgine user database for usernames containing non-alphanumeric characters, angle brackets, or encoded payloads.
Inspect browser DevTools or proxy logs when loading the admin user management page for unexpected script execution.
Correlate reNgine web access logs with administrator activity to identify anomalous requests tied to user listing views.

Monitoring Recommendations

Enable web application firewall rules to flag HTML and JavaScript metacharacters submitted to reNgine user creation endpoints.
Monitor reNgine container and application logs for user creation events originating from unexpected source IPs or privileged accounts.
Alert on administrator browser sessions generating outbound requests immediately after accessing user management pages.

How to Mitigate CVE-2025-24967

Immediate Actions Required

Restrict access to the reNgine admin panel to trusted networks only, using firewall rules, VPN enforcement, or reverse proxy allowlisting.
Audit existing reNgine user accounts and remove or rename any accounts containing suspicious characters in the username field.
Rotate administrator credentials and session tokens if indicators of exploitation are present.

Patch Information

At the time of publication, no patched release addressing CVE-2025-24967 was identified in the advisory. Users should monitor the reNgine GitHub repository and the GitHub Security Advisory GHSA-23wx-5q5w-334w for future releases that remediate this issue.

Workarounds

The vendor advisory states there are no known workarounds for this vulnerability.
As a compensating control, limit the ability to create or modify reNgine users to a minimal set of trusted operators.
Deploy a reverse proxy with input filtering or a Content Security Policy header that blocks inline script execution on admin pages.

bash

# Example nginx reverse proxy header enforcing a restrictive CSP for the reNgine admin panel
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;