CVE-2025-40706 Overview
CVE-2025-40706 is a stored Cross-Site Scripting (XSS) vulnerability affecting OpenAtlas version 8.9.0, developed by the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH). The flaw resides in the /insert/source endpoint, specifically in the handling of the name parameter during POST requests. OpenAtlas fails to validate or sanitize user input before rendering it back to authenticated users. An attacker with low privileges can inject arbitrary JavaScript that executes in the context of other authenticated users, enabling session cookie theft and account takeover. The issue is categorized under [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated attackers can inject persistent JavaScript via the /insert/source endpoint to hijack sessions of other OpenAtlas users.
Affected Products
- OpenAtlas 8.9.0 (ACDH-CH / craws)
- Deployments exposing the /insert/source form to multiple authenticated users
- Instances running cpe:2.3:a:craws:openatlas:8.9.0
Discovery Timeline
- 2025-08-29 - CVE-2025-40706 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-40706
Vulnerability Analysis
OpenAtlas is a web application used by digital humanities researchers to document historical and archaeological data. The /insert/source route accepts user-supplied values for a new source record, including the name field. The application stores this input and later renders it in subsequent pages without proper HTML encoding or input validation.
An authenticated user with sufficient privileges to create a source record submits a crafted POST request containing JavaScript payloads in the name parameter. When another authenticated user views the affected page, the browser executes the payload under the application's origin. This grants the attacker access to the session cookie, CSRF tokens, and any data accessible via the DOM.
Because the payload is persisted server-side, exploitation does not require social engineering of the victim beyond normal application usage. The attacker leverages the trust relationship between the browser and the application.
Root Cause
The root cause is inadequate output encoding and missing server-side input validation on the name parameter processed by /insert/source. OpenAtlas treats the stored value as safe markup instead of untrusted data, violating standard contextual output encoding practice.
Attack Vector
Exploitation requires network access to the OpenAtlas instance and valid low-privilege credentials capable of submitting a source entry. The attack vector is remote over HTTP(S) and relies on user interaction, specifically a second authenticated user viewing the malicious record. Full technical details are available in the INCIBE Security Notice on XSS and the OpenAtlas project repository.
Detection Methods for CVE-2025-40706
Indicators of Compromise
- POST requests to /insert/source containing HTML tags, <script> elements, or JavaScript event handlers in the name parameter.
- Outbound HTTP requests from authenticated user browsers to attacker-controlled domains carrying cookie or session token values.
- Unexpected modifications to source records containing encoded payloads such as %3Cscript%3E or javascript: URIs.
Detection Strategies
- Deploy web application firewall rules that inspect the name parameter on /insert/source for script tags, event handlers, and JavaScript URIs.
- Review OpenAtlas application logs for POST requests to the vulnerable endpoint containing non-alphanumeric characters typical of XSS payloads.
- Correlate anomalous outbound DNS or HTTP traffic from workstations immediately after users access OpenAtlas source pages.
Monitoring Recommendations
- Enable verbose HTTP request logging on the reverse proxy or application server fronting OpenAtlas.
- Monitor for session anomalies such as concurrent sessions from different geographic locations using the same account.
- Audit all stored source records created on or after August 29, 2025 for embedded HTML or JavaScript content.
How to Mitigate CVE-2025-40706
Immediate Actions Required
- Upgrade OpenAtlas to a release later than 8.9.0 that addresses the input validation flaw.
- Audit existing source records for malicious payloads and remove any confirmed injected content.
- Rotate authentication cookies and force re-authentication of all active OpenAtlas users.
- Restrict account creation privileges and review which users have access to the /insert/source endpoint.
Patch Information
No vendor advisory URL is listed in the NVD record. Administrators should monitor the OpenAtlas project repository for releases newer than 8.9.0 and apply the fix as soon as it is available. Refer to the INCIBE Security Notice on XSS for coordinated disclosure context.
Workarounds
- Place OpenAtlas behind a WAF with rules that block script tags and JavaScript event handlers in POST bodies to /insert/source.
- Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins.
- Set the HttpOnly and Secure flags on session cookies to limit theft via injected JavaScript.
- Limit access to the OpenAtlas instance to trusted networks via VPN or IP allowlisting until a patched release is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
