CVE-2025-40705 Overview
CVE-2025-40705 is a stored Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0, a research data management platform developed by the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH). The flaw results from inadequate validation of user input in the name parameter of the /insert/acquisition endpoint when processing POST requests. An authenticated attacker can inject malicious JavaScript that executes in the browser context of other authenticated users. Successful exploitation enables theft of session cookies and hijacking of authenticated sessions. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated attackers can inject persistent JavaScript via the /insert/acquisition endpoint to steal session cookies and hijack user sessions.
Affected Products
- OpenAtlas v8.9.0 (craws/openatlas)
- Deployments maintained by the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH)
- Any downstream fork or instance built on the vulnerable 8.9.0 release
Discovery Timeline
- 2025-08-29 - CVE-2025-40705 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-40705
Vulnerability Analysis
The vulnerability is a stored XSS condition in the acquisition record creation workflow of OpenAtlas. When an authenticated user submits a POST request to /insert/acquisition, the application accepts the name parameter without sufficient output encoding or input sanitization. The injected payload is persisted in the application database and later rendered inside pages served to other users.
When a victim views a page that renders the stored value, the browser executes the attacker-controlled script. Because OpenAtlas is a web application used by researchers to manage historical and archaeological datasets, stolen session cookies grant access to the catalog, user accounts, and administrative functions depending on the victim's role.
Root Cause
The root cause is improper neutralization of HTML and JavaScript control characters in the name field during form processing. The application fails to apply context-aware output encoding when the stored value is rendered in subsequent server responses. This mirrors the standard CWE-79 pattern where untrusted input flows directly into an HTML sink.
Attack Vector
Exploitation requires network access to the OpenAtlas instance, low-privilege authenticated access to submit records, and user interaction from the victim to view the affected page. The attacker submits a crafted name value containing a JavaScript payload through the /insert/acquisition endpoint. When a privileged user accesses the record, the payload runs in their session context and can exfiltrate document.cookie or perform actions on their behalf. Full technical details are available in the INCIBE Security Notice on XSS in OpenAtlas.
No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose per the published advisory.
Detection Methods for CVE-2025-40705
Indicators of Compromise
- POST requests to /insert/acquisition where the name parameter contains HTML tags such as <script>, <img, <svg, or event handler attributes like onerror= and onload=.
- Outbound HTTP requests from browsers of authenticated OpenAtlas users to unknown third-party domains shortly after rendering acquisition records.
- Database rows in acquisition tables containing encoded or raw JavaScript sequences in the name field.
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule that inspects POST bodies for script tags, JavaScript URIs, and HTML event handlers targeting /insert/acquisition.
- Review web server access logs for sequences of record creation followed by views of the same record from a different authenticated session.
- Run periodic database queries to flag stored values containing <, >, javascript:, or on[a-z]+= patterns in text fields.
Monitoring Recommendations
- Centralize OpenAtlas application and web server logs in a SIEM for correlation of request bodies with user sessions and downstream rendering events.
- Alert on anomalous session cookie usage, including concurrent sessions from different IP addresses or geolocations for the same user.
- Monitor Content Security Policy (CSP) violation reports if CSP is enforced in reporting mode.
How to Mitigate CVE-2025-40705
Immediate Actions Required
- Upgrade OpenAtlas to a version later than 8.9.0 that remediates the input validation defect, per guidance from the OpenAtlas GitHub repository.
- Restrict access to the /insert/acquisition endpoint to trusted users and require re-authentication for sensitive actions.
- Invalidate active sessions and rotate session secrets after patching to evict any attacker-controlled sessions.
Patch Information
Refer to the OpenAtlas GitHub repository for the latest release and commit history addressing input validation on acquisition records. The INCIBE Security Notice on XSS in OpenAtlas tracks remediation status and related XSS findings in the same product family.
Workarounds
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
- Set the HttpOnly and Secure flags on session cookies to block JavaScript access and limit transport to HTTPS.
- Deploy a WAF rule to reject POST requests to /insert/acquisition where the name parameter contains HTML tags or JavaScript event handlers.
- Limit the number of accounts with write permissions on acquisition records until the patched version is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
