CVE-2025-40703: Craws Openatlas XSS Vulnerability

CVE-2025-40703 Overview

CVE-2025-40703 is a stored Cross-Site Scripting (XSS) vulnerability affecting OpenAtlas version 8.9.0, developed by the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH). The flaw stems from inadequate validation of user-supplied input in POST requests submitted through the /insert/group endpoint. Attackers can inject malicious script payloads through the name and alias-0 parameters. Authenticated users who process a crafted request may have their session cookies stolen or actions performed on their behalf. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation enables session cookie theft from authenticated OpenAtlas users, potentially leading to account takeover within the historical research platform.

Affected Products

OpenAtlas 8.9.0 by craws (ACDH-CH)
The /insert/group endpoint accepting the name parameter
The /insert/group endpoint accepting the alias-0 parameter

Discovery Timeline

2025-08-29 - CVE-2025-40703 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40703

Vulnerability Analysis

The vulnerability resides in the OpenAtlas group insertion workflow. When a user submits a POST request to /insert/group, the application accepts values for the name and alias-0 parameters without applying sufficient output encoding or input sanitization. An attacker can embed HTML or JavaScript payloads that are later rendered in the browser context of another authenticated user.

OpenAtlas is a collaborative research platform used for cataloging historical and archaeological data. Because it typically operates behind authentication and stores curated records, injected scripts persist and execute whenever an authenticated user views the affected group entry. This turns the flaw into a vector for stealing session cookies, hijacking accounts, or manipulating displayed research data.

Root Cause

The root cause is improper neutralization of input during web page generation, classified as [CWE-79]. The application does not encode special characters such as <, >, and quotation marks before writing the name and alias-0 values into HTML responses. As a result, browser rendering treats injected script content as executable code rather than data.

Attack Vector

Exploitation requires network access to the OpenAtlas web interface and low-privilege authenticated access to submit the crafted POST request. User interaction is required, because the payload triggers when a second authenticated user renders the poisoned group record. See the INCIBE Security Notice on XSS for advisory context and the GitHub OpenAtlas Repository for source references.

Detection Methods for CVE-2025-40703

Indicators of Compromise

POST requests to /insert/group containing HTML tags, <script> fragments, or event-handler attributes such as onerror= or onload= within the name or alias-0 parameters.
Unexpected outbound requests from authenticated user browsers to attacker-controlled domains shortly after loading OpenAtlas group pages.
Unusual session activity, such as concurrent sessions from disparate IP addresses tied to the same authenticated OpenAtlas account.

Detection Strategies

Inspect web server access logs for POST bodies containing URL-encoded HTML metacharacters targeting the /insert/group endpoint.
Deploy Web Application Firewall (WAF) rules that flag script-like payloads within form parameters submitted to OpenAtlas.
Perform periodic content review of stored group records for embedded HTML or JavaScript that should not appear in curated research data.

Monitoring Recommendations

Enable verbose HTTP request logging on the OpenAtlas application server, including POST request bodies where privacy policy allows.
Forward web application and authentication logs to a centralized analytics platform to correlate injection attempts with subsequent session activity.
Alert on anomalous cookie-bearing requests originating from unexpected geographies or user agents.

How to Mitigate CVE-2025-40703

Immediate Actions Required

Restrict access to the OpenAtlas administrative interface to trusted networks or through a Virtual Private Network (VPN) until a patched release is deployed.
Audit existing group records for injected HTML or JavaScript and remove any suspicious content.
Rotate session secrets and force reauthentication for all OpenAtlas users to invalidate potentially stolen session cookies.

Patch Information

No vendor advisory URL is listed in the CVE record at the time of publication. Administrators should monitor the GitHub OpenAtlas Repository for releases superseding version 8.9.0 and apply updates as they become available. Refer to the INCIBE Security Notice on XSS for coordinated disclosure details.

Workarounds

Deploy a WAF rule that blocks POST requests to /insert/group when the name or alias-0 parameters contain HTML tags or JavaScript event handlers.
Enforce a strict Content Security Policy (CSP) that disallows inline script execution to reduce the impact of injected payloads.
Set the HttpOnly and Secure attributes on session cookies to limit script-based cookie theft over insecure channels.

bash

# Example nginx Content Security Policy header to reduce XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;