CVE-2025-3570: Db-hospital-drug XSS Vulnerability

CVE-2025-3570 Overview

CVE-2025-3570 is a stored cross-site scripting (XSS) vulnerability in JamesZBL code-projects db-hospital-drug version 1.0. The flaw resides in the Save function of ContentController.java, where the content parameter is stored and rendered without proper sanitization. An authenticated remote attacker can inject malicious JavaScript that executes in the browser of any user who views the affected content. The exploit details have been publicly disclosed, and the vendor did not respond to disclosure attempts. This weakness is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact

Attackers with low-privilege access can inject persistent JavaScript payloads that execute in victim browsers, enabling session theft, credential harvesting, and unauthorized actions within the hospital drug management application.

Affected Products

• JamesZBL db-hospital-drug version 1.0
• Component: ContentController.java — Save function
• Parameter: content

Discovery Timeline

• 2025-04-14 - CVE-2025-3570 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3570

Vulnerability Analysis

The vulnerability originates in the Save method of ContentController.java within the db-hospital-drug application. User-supplied data passed through the content argument is persisted to the backend without input validation or output encoding. When the stored content is later rendered in a web page, the browser interprets any embedded HTML or JavaScript as executable code.

This is a classic stored XSS pattern. Because the payload is saved server-side, every user who views the affected view triggers execution. The attack requires only low privileges (PR:L) and user interaction (UI:P) to view the injected content, making it viable within multi-user hospital environments where staff routinely review drug records.

The application appears to lack a centralized encoding layer for Java Server-side templating output. Without contextual escaping at the sink, any controller that echoes stored fields into HTML will propagate the injection.

Root Cause

The root cause is missing input sanitization and output encoding in the Save handler. The content parameter is trusted as-is when written to storage, and the corresponding view layer does not apply HTML entity encoding before rendering the field. This dual failure — neither validating on input nor encoding on output — is the defining pattern of CWE-79.

Attack Vector

An attacker authenticates to the application with any account that can invoke the Save action. The attacker submits a crafted content value containing an HTML or JavaScript payload, for example a <script> element or an event-handler attribute on an injected tag. The malicious content is stored in the database. When another user, such as an administrator or clinician, loads the page that displays the stored value, the injected script runs in that user's session context. Consequences include session cookie theft, forced actions via the authenticated session, keystroke logging on the affected page, and pivoting into internal hospital systems accessible from the browser.

No verified exploit code is published in a machine-readable form. Technical write-up details are available in the GitHub XSS Vulnerability Report and the VulDB entry #304611.

Detection Methods for CVE-2025-3570

Indicators of Compromise

• Stored records in db-hospital-drug tables containing HTML tags such as <script>, <img onerror=...>, <svg onload=...>, or javascript: URIs in the content field.
• HTTP POST requests to the Save endpoint of ContentController carrying encoded or raw script payloads in the content parameter.
• Outbound browser requests from staff workstations to unfamiliar domains immediately after loading a content page — a signature of exfiltration via injected script.

Detection Strategies

• Deploy a web application firewall (WAF) rule set that inspects request bodies for XSS signatures targeting the content parameter on the Save route.
• Perform database content scans for stored payloads matching common XSS patterns in the content column.
• Review application logs for repeated Save requests from a single low-privilege account, which may indicate probing.

Monitoring Recommendations

• Enable Content Security Policy (CSP) reporting and monitor report-uri endpoints for policy violations originating from application pages.
• Alert on browser-side script errors and unexpected script sources loaded from the application origin.
• Correlate authenticated Save actions with subsequent viewer sessions to identify propagation of injected content.

How to Mitigate CVE-2025-3570

Immediate Actions Required

• Restrict access to the Save endpoint of ContentController.java to trusted users only until a code-level fix is deployed.
• Sanitize existing stored data in the content field by stripping or encoding HTML markup already persisted in the database.
• Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources to limit exploitability.
• Rotate session tokens and credentials for accounts that accessed affected pages during the exposure window.

Patch Information

The vendor was contacted about this disclosure but did not respond, and no official patch is listed in the vendor advisory references. Operators of db-hospital-drug 1.0 should apply source-level fixes internally. Recommended remediation is to encode all user-supplied content at the rendering layer using an HTML entity encoder such as OWASP Java Encoder (Encode.forHtml(content)), and to validate input against an allowlist of permitted characters at the Save controller. Refer to the VulDB entry for tracking updates.

Workarounds

• Place the application behind a WAF configured with OWASP Core Rule Set XSS signatures.
• Apply a restrictive Content Security Policy header, for example default-src 'self'; script-src 'self'; object-src 'none'.
• Disable or firewall the application from broad internal network access until remediated.
• Require reviewer accounts to use browser isolation when accessing hospital drug content pages.

# Example CSP header applied at reverse proxy (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;