CVE-2025-27500: OpenZiti Admin Panel XSS Vulnerability

CVE-2025-27500 Overview

CVE-2025-27500 affects OpenZiti, an open source project that brings zero trust networking to applications. The ziti-console admin panel exposes an /api/upload endpoint that accepts HTTP POST file uploads without authentication. Uploaded files are stored on the node and made available via URL. An attacker can upload a file containing malicious script content, which executes in a victim's browser when the file is accessed. This results in stored cross-site scripting [CWE-79]. The maintainers disabled the endpoint because it is no longer required after ziti-console moved from a Node.js server application to a single-page application. The vulnerability is fixed in version 3.7.1.

Critical Impact
Unauthenticated attackers can upload arbitrary files to the OpenZiti admin console, enabling stored XSS execution in the context of authenticated administrators' browsers.

Affected Products

OpenZiti ziti-console versions prior to 3.7.1
OpenZiti deployments exposing the admin panel to untrusted networks
Self-hosted OpenZiti controllers using the legacy Node.js console

Discovery Timeline

2025-03-03 - CVE-2025-27500 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27500

Vulnerability Analysis

The vulnerability resides in the ziti-console administrative interface shipped with OpenZiti. The /api/upload route processes HTTP POST requests carrying file payloads and writes them to disk. The route does not require authentication tokens, session cookies, or any authorization check before accepting the upload.

Uploaded files are subsequently retrievable through a predictable URL served by the same origin as the admin console. When an administrator visits the URL of an attacker-controlled file, the browser renders and executes any embedded scripts. This produces stored cross-site scripting persisted on the server.

Because execution occurs in the origin of the admin console, an attacker can steal session material, issue authenticated API calls to the OpenZiti controller, or manipulate zero trust network configurations through the victim's browser.

Root Cause

The /api/upload handler was designed for a legacy workflow when ziti-console operated as a Node.js server application. The handler lacks authentication middleware and does not validate file content types, extensions, or filenames. Combined with serving uploaded files from a web-accessible path, this creates the stored XSS primitive tracked as [CWE-79].

Attack Vector

An attacker sends an unauthenticated HTTP POST to the /api/upload endpoint of an exposed ziti-console instance. The payload contains an HTML or SVG file with embedded JavaScript. The server stores the file and returns a URL. The attacker then delivers this URL to an administrator through phishing, chat, or another social channel. When the administrator opens the link, the script executes with the privileges of the console session. Exploitation requires user interaction, as reflected in the CVSS vector component UI:R.

No verified public exploit code is available. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-frxm-vm48-5qf2.

Detection Methods for CVE-2025-27500

Indicators of Compromise

HTTP POST requests to /api/upload on ziti-console hosts originating from unauthenticated sources or unexpected IP addresses
Files with HTML, SVG, or JavaScript content stored in the console upload directory
Administrator browser sessions issuing unusual controller API calls immediately after visiting an upload URL
Outbound requests from administrator browsers to attacker-controlled domains after console access

Detection Strategies

Review web server and reverse proxy logs for POST requests to /api/upload and correlate against known administrator source addresses
Inspect the upload storage directory for files containing <script>, onerror=, or SVG script payloads
Monitor OpenZiti controller audit logs for configuration changes that follow shortly after console URL access events

Monitoring Recommendations

Alert on any HTTP request to /api/upload on ziti-console versions prior to 3.7.1
Deploy Content Security Policy reporting to capture script execution originating from stored files
Forward ziti-console access logs and controller audit events to a centralized log platform for correlation and retention

How to Mitigate CVE-2025-27500

Immediate Actions Required

Upgrade ziti-console to version 3.7.1 or later, where the vulnerable endpoint is disabled
Restrict network access to the OpenZiti admin console using firewall rules or a bastion host until patching is complete
Audit the upload directory and remove any files that were not placed by legitimate administrators
Rotate administrator session tokens and credentials that may have been exposed through XSS execution

Patch Information

The maintainers fixed the vulnerability in OpenZiti ziti-console version 3.7.1 by disabling the /api/upload endpoint. The endpoint is no longer required because ziti-console now operates as a single-page application. Details are published in the GitHub Security Advisory GHSA-frxm-vm48-5qf2.

Workarounds

Block requests to /api/upload at an upstream reverse proxy or web application firewall
Require authenticated access to the entire ziti-console interface via network-level controls such as VPN or mutual TLS
Serve uploaded files, if any remain, with Content-Disposition: attachment and a restrictive Content Security Policy to prevent script execution

bash

# Example nginx rule to block the vulnerable endpoint until upgrade
location = /api/upload {
    return 403;
}