CVE-2025-27867: Apache Felix Http Webconsole Plugin XSS

CVE-2025-27867 Overview

CVE-2025-27867 is a cross-site scripting (XSS) vulnerability in the Apache Felix HTTP Webconsole Plugin. The flaw stems from improper neutralization of user-supplied input during web page generation, categorized under [CWE-79]. Affected releases include the 1.x branch through version 1.2.0, and the Apache Felix project recommends upgrading to version 1.2.2 to remediate the issue. The plugin exposes an administrative web console used to manage OSGi bundles and configuration, making script injection in this interface relevant to any operator running an exposed Felix instance.

Critical Impact
An attacker who successfully injects script content into the web console can execute JavaScript in the browser context of an administrator, potentially leading to session compromise, unauthorized configuration changes, or pivot into managed OSGi services.

Affected Products

Apache Felix HTTP Webconsole Plugin 1.x through 1.2.0
Apache Felix HTTP Webconsole Plugin 1.2.1 (superseded by fixed release)
Fixed in Apache Felix HTTP Webconsole Plugin 1.2.2

Discovery Timeline

2025-03-12 - CVE-2025-27867 published to the National Vulnerability Database
2025-03-12 - Vendor advisory posted to the Apache mailing list
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27867

Vulnerability Analysis

The Apache Felix HTTP Webconsole Plugin renders administrative pages that incorporate request-derived values without applying sufficient output encoding. When an attacker crafts a request containing HTML or JavaScript payloads, the plugin reflects those values into the response markup, permitting client-side script execution in a victim administrator's browser.

Exploitation requires an authenticated administrator to interact with the malicious content, and the attack complexity is elevated because specific conditions must be met to trigger the injection. Successful exploitation grants the attacker limited impact on confidentiality, integrity, and availability of the web console session. Because the plugin operates the OSGi management interface, script execution in this context can be leveraged to modify bundle state, install components, or exfiltrate configuration data visible to the administrator.

Root Cause

The root cause is missing or insufficient contextual output encoding in the plugin's HTML generation path. User-controllable request parameters flow into the rendered document without being escaped for the HTML, attribute, or JavaScript contexts in which they appear. This aligns with the [CWE-79] pattern of improper neutralization of input during web page generation.

Attack Vector

The vulnerability is exploitable over the network. An attacker delivers a crafted URL or form submission targeting the web console, typically via a phishing message or embedded link. When an authenticated administrator loads the malicious request, the injected payload executes in their browser under the origin of the Felix Web Console. No local access or privileged position on the network is required, but user interaction is not needed once the malicious request is triggered by the victim.

No public proof-of-concept exploit or exploit database entry has been published for CVE-2025-27867 at the time of writing. See the Apache Mailing List Thread and Openwall OSS Security Update for the vendor's technical description.

Detection Methods for CVE-2025-27867

Indicators of Compromise

HTTP requests to Felix Web Console endpoints containing <script>, javascript:, onerror=, or URL-encoded equivalents in query strings or POST bodies.
Web server access logs showing anomalous parameter values with HTML entity fragments targeting the /system/console/ path.
Administrator browser sessions issuing unexpected OSGi bundle install, update, or configuration API calls shortly after visiting an external link.

Detection Strategies

Deploy web application firewall rules that inspect requests to Felix Web Console paths for reflected XSS payload signatures and encoded script fragments.
Correlate authenticated admin sessions with outbound requests to unknown domains that could serve as exfiltration endpoints for stolen session tokens.
Review Felix audit logs for configuration or bundle changes that do not map to a legitimate change ticket or administrator action.

Monitoring Recommendations

Enable verbose logging on the Apache Felix HTTP service and forward logs to a centralized analytics platform for query and retention.
Alert on any HTTP 200 responses from Web Console endpoints that echo request-derived script content in the response body.
Track the plugin version in software inventory to identify hosts still running 1.2.0 or earlier.

How to Mitigate CVE-2025-27867

Immediate Actions Required

Upgrade the Apache Felix HTTP Webconsole Plugin to version 1.2.2 or later on all instances.
Restrict network access to the /system/console/ administrative interface using firewall rules, reverse proxy allowlists, or VPN-only access.
Require administrators to log out of the Felix Web Console when not actively administering the system to reduce the window for reflected XSS abuse.

Patch Information

The Apache Felix project has released version 1.2.2 of the HTTP Webconsole Plugin, which corrects the improper input neutralization. Update the plugin coordinate in your build manifest (Maven, Gradle, or OSGi bundle deployment) to reference 1.2.2 and redeploy. Refer to the Apache Mailing List Thread for the official announcement.

Workarounds

Block direct internet exposure of the Felix Web Console by binding the HTTP service to an internal interface only.
Enforce a strict Content Security Policy (CSP) on the reverse proxy fronting the console to constrain inline script execution.
Require multi-factor authentication and short session timeouts for administrative accounts that access the plugin.

bash

# Example: update the Felix HTTP Webconsole Plugin coordinate in Maven
mvn versions:use-dep-version \
  -Dincludes=org.apache.felix:org.apache.felix.webconsole.plugins.ds \
  -DdepVersion=1.2.2 \
  -DforceVersion=true