CVE-2025-3391: Hailey888 OA System XSS Vulnerability

CVE-2025-3391 Overview

CVE-2025-3391 is a cross-site scripting (XSS) vulnerability in the hailey888 oa_system office automation application, affecting versions up to 2025.01.01. The flaw resides in the outAddress function within cn/gson/oass/controller/address/AddrController.java in the backend component. Attackers can manipulate the outtype argument to inject arbitrary script content that executes in the victim's browser session. The exploit has been publicly disclosed and can be launched remotely, though it requires authenticated access and user interaction. Because oa_system uses a rolling release model, discrete fixed version numbers are not published by the vendor.

Critical Impact
Authenticated attackers can inject JavaScript through the outtype parameter to hijack sessions, deface pages, or pivot to internal OA data via reflected/stored XSS.

Affected Products

hailey888 oa_system up to 2025.01.01
Backend component: cn/gson/oass/controller/address/AddrController.java
Vulnerable function: outAddress

Discovery Timeline

2025-04-08 - CVE-2025-3391 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3391

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw [CWE-79] in the address export handler of oa_system. The outAddress method in AddrController.java accepts an outtype request parameter that controls the export format branch. The application echoes the attacker-controlled value back into the response without proper output encoding or input validation. When a victim visits a crafted link or triggers the export flow, the injected script executes within the OA application's origin.

Exploitation requires low privileges and user interaction, which limits mass exploitation but keeps the attack viable against internal OA users through phishing or crafted intranet links. Successful attacks can steal session cookies, perform actions on behalf of the user, and exfiltrate directory data accessible in the OA context.

Root Cause

The root cause is missing neutralization of user-supplied input during web page generation. The outtype parameter flows from the HTTP request into response output without HTML entity encoding or allow-list validation, violating standard output encoding practice for Spring MVC controllers.

Attack Vector

The attack vector is network-based over HTTP(S) against the OA backend. An attacker crafts a URL invoking the outAddress endpoint with a malicious outtype payload. The victim, an authenticated OA user, clicks the link or is redirected to it, at which point the injected payload renders in the browser. The vulnerability mechanism is documented in the Gitee Issue Discussion and the VulDB entry #303637.

Detection Methods for CVE-2025-3391

Indicators of Compromise

HTTP requests to the outAddress endpoint containing <script>, javascript:, onerror=, or encoded variants in the outtype query parameter.
Web server access logs showing unusually long or URL-encoded outtype values originating from unexpected referrers.
Browser telemetry showing script execution or unexpected outbound requests immediately following visits to the OA address module.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect the outtype parameter on any AddrController route for XSS payload patterns.
Correlate authenticated session activity with anomalous DOM events or outbound requests to attacker-controlled hosts.
Review application logs for HTTP 200 responses to the address export endpoint where outtype deviates from the expected enumerated values.

Monitoring Recommendations

Enable verbose request logging on oa_system backend controllers and forward logs to a centralized analytics platform for query and retention.
Alert on repeated failed or malformed export requests from a single session, which may indicate payload tuning.
Monitor egress traffic from OA user workstations for beacons to newly registered domains after OA portal usage.

How to Mitigate CVE-2025-3391

Immediate Actions Required

Pull the latest hailey888 oa_system rolling release from the upstream repository and redeploy the backend component.
Restrict access to the OA backend to trusted internal networks and enforce authentication on every endpoint under AddrController.
Apply strict input validation on the outtype parameter, allowing only a fixed set of known export type values.

Patch Information

The vendor distributes oa_system as a rolling release, so no discrete patched version identifier is published. Operators should track the upstream repository and apply the most recent commits that address input handling in AddrController.java. Refer to the Gitee Issue Discussion for remediation status.

Workarounds

Add a server-side allow-list validator that rejects any outtype value not matching the expected export format tokens.
Configure a Content Security Policy (CSP) response header disallowing inline scripts to reduce XSS impact.
Deploy WAF rules blocking common XSS payload signatures on request parameters targeting the address controller.

bash

# Example nginx rule to block obvious XSS payloads on the address controller
location ~* /address/outAddress {
    if ($arg_outtype ~* "(<|%3C)script|javascript:|onerror=|onload=") {
        return 403;
    }
}