CVE-2025-33118 Overview
CVE-2025-33118 is a stored cross-site scripting (XSS) vulnerability in IBM QRadar Security Information and Event Manager (SIEM) 7.5 through 7.5.0 Update Pack 12. Authenticated users can embed arbitrary JavaScript in the Web UI, which executes in the browsers of other users viewing the affected content. Successful exploitation can alter intended application functionality and disclose credentials within a trusted session. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
An authenticated attacker can inject persistent JavaScript into the QRadar Web UI, enabling session hijacking, credential theft, and unauthorized actions performed under a victim analyst's identity.
Affected Products
- IBM QRadar SIEM 7.5.0 (base release)
- IBM QRadar SIEM 7.5.0 Update Pack 1 through Update Pack 11
- IBM QRadar SIEM 7.5.0 Update Pack 12
Discovery Timeline
- 2025-08-01 - CVE-2025-33118 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-33118
Vulnerability Analysis
The flaw is a stored (persistent) XSS issue in the QRadar SIEM Web UI. An authenticated user with access to a field that renders back into the interface can submit input containing JavaScript payloads. The application stores the value without sufficient neutralization and later renders it to other authenticated users. When a victim views the affected page, the payload executes in the victim's browser context under the QRadar origin.
Exploitation requires an authenticated session with low privileges and user interaction from the victim analyst. Because the injected script runs inside a trusted session, it can read session tokens, exfiltrate credentials submitted through the UI, invoke QRadar API endpoints, and manipulate rendered content such as offense views or dashboards. The scope change reflected in the vulnerability metrics indicates that impact extends beyond the vulnerable component into other browser-side security boundaries.
Root Cause
The root cause is improper output encoding of user-supplied input rendered into the QRadar Web UI. Input accepted from an authenticated user is persisted and later reflected into HTML without contextual escaping, allowing <script> fragments or event-handler attributes to be interpreted by the browser as executable code rather than data.
Attack Vector
The attack vector is network-based through the QRadar Web UI. An authenticated attacker submits a payload into a UI field that is later viewed by another user, such as an analyst reviewing shared content. When rendered, the browser executes the attacker's JavaScript inside the QRadar session context. No specialized tooling is required beyond a standard browser and valid credentials.
See the IBM Support Page for CVE-2025-33118 for vendor-supplied details.
Detection Methods for CVE-2025-33118
Indicators of Compromise
- Unexpected <script>, onerror, onload, or javascript: strings appearing in stored QRadar configuration fields, notes, or user-editable content
- Outbound browser requests from analyst workstations to unfamiliar domains immediately after viewing QRadar pages
- Authenticated QRadar API calls originating from analyst sessions that do not match normal workflows
- New or modified QRadar user accounts, saved searches, or rules created shortly after a suspicious UI view
Detection Strategies
- Inspect QRadar application and audit logs for entries where user-submitted fields contain HTML or JavaScript syntax
- Correlate web proxy logs with QRadar session activity to identify anomalous cross-origin requests initiated from the QRadar Web UI
- Deploy Content Security Policy (CSP) reporting endpoints to capture blocked inline script attempts in the QRadar interface
- Review browser telemetry from analyst endpoints for script execution anomalies while interacting with QRadar
Monitoring Recommendations
- Alert on creation or modification of QRadar objects containing HTML control characters such as <, >, ", or javascript:
- Monitor privileged QRadar account activity for actions taken shortly after low-privileged users submit UI content
- Track failed and successful authentication events for QRadar administrative users to identify session-riding behavior
- Retain and review Web UI access logs for at least 90 days to support post-incident investigation
How to Mitigate CVE-2025-33118
Immediate Actions Required
- Apply the IBM-supplied fix referenced in the IBM Support advisory to all QRadar SIEM 7.5.0 deployments through Update Pack 12
- Audit existing stored content in the QRadar Web UI for injected script payloads and remove any suspicious entries
- Restrict QRadar Web UI access to trusted networks and enforce least-privilege role assignments
- Rotate credentials and session tokens for any user who may have viewed injected content
Patch Information
IBM has published remediation guidance for CVE-2025-33118 on the IBM Support Page. Administrators should apply the recommended QRadar SIEM update that supersedes 7.5.0 Update Pack 12 and follow IBM's post-installation validation steps. Verify that all managed hosts and consoles in the QRadar deployment are upgraded to a consistent, patched version.
Workarounds
- Enforce a strict browser Content Security Policy in front of the QRadar Web UI to block inline script execution where feasible
- Require multi-factor authentication for all QRadar user accounts to limit the impact of session or credential theft
- Limit which roles can create or modify shared UI content such as dashboards, saved searches, and notes
- Educate analysts to avoid opening unexpected shared QRadar content from lower-privileged users until the patch is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
