CVE-2025-40707 Overview
CVE-2025-40707 is a stored Cross-Site Scripting (XSS) vulnerability in OpenAtlas version 8.9.0, a database platform developed by the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH). The flaw stems from inadequate validation of user input submitted through POST requests to the /insert/place endpoint. Attackers can inject malicious JavaScript via the name and alias-0 parameters. When a victim views the affected record, the script executes in their browser context. This enables session cookie theft and account impersonation against authenticated users.
Critical Impact
Authenticated attackers can inject persistent JavaScript payloads that execute in victims' browsers, enabling session hijacking and unauthorized actions within OpenAtlas.
Affected Products
- OpenAtlas 8.9.0 (ACDH-CH / craws)
- Deployments exposing /insert/place to authenticated users
- Instances without upstream input sanitization
Discovery Timeline
- 2025-08-29 - CVE-2025-40707 published to NVD
- 2026-10-18 - Last updated in NVD database
Technical Details for CVE-2025-40707
Vulnerability Analysis
The vulnerability is classified under [CWE-79], Improper Neutralization of Input During Web Page Generation. OpenAtlas accepts POST data for place records without neutralizing HTML or JavaScript content. The name and alias-0 fields are stored and later rendered in the application interface. When another authenticated user views the injected record, the browser interprets the payload as executable script.
Exploitation requires low privileges and user interaction, which aligns with authenticated contributors creating or editing place entries in collaborative research environments. Because OpenAtlas is used by academic and cultural heritage institutions, successful exploitation can expose researcher sessions and institutional accounts.
Root Cause
The root cause is missing output encoding and insufficient server-side input validation on parameters submitted to the /insert/place endpoint. The application trusts user-supplied strings and renders them directly into the DOM without contextual escaping.
Attack Vector
The attack is executed over the network against an authenticated OpenAtlas instance. An attacker with valid credentials sends a POST request to /insert/place containing crafted script payloads in the name or alias-0 fields. The payload persists in the database. When a legitimate authenticated user navigates to the record, the stored script executes under that user's session, enabling cookie exfiltration and arbitrary actions in the victim's authenticated context.
See the INCIBE Security Notice: XSS Vulnerabilities and the GitHub OpenAtlas Repository for additional technical references.
Detection Methods for CVE-2025-40707
Indicators of Compromise
- POST requests to /insert/place containing <script>, onerror=, or javascript: tokens in name or alias-0 parameters
- Database records in the places table containing HTML or JavaScript syntax within string fields
- Outbound HTTP requests from authenticated user browsers to attacker-controlled hosts following record access
- Session cookie values appearing in web server referrer logs or external DNS queries
Detection Strategies
- Deploy a web application firewall rule inspecting POST bodies to /insert/place for script tags and event handler attributes
- Review OpenAtlas application logs for place record creation events with anomalously long or structured string fields
- Correlate authenticated user activity with outbound network connections to untrusted domains
Monitoring Recommendations
- Enable verbose HTTP request logging on the OpenAtlas reverse proxy, capturing full POST bodies
- Monitor browser Content Security Policy (CSP) violation reports if CSP is deployed
- Audit account creation and privilege changes to limit the pool of users who can submit place records
How to Mitigate CVE-2025-40707
Immediate Actions Required
- Restrict access to the /insert/place endpoint to trusted authenticated users only
- Deploy a web application firewall rule to filter script injection patterns in POST parameters
- Audit existing place records for stored HTML or JavaScript content and sanitize affected entries
- Rotate session cookies and force reauthentication for all users following remediation
Patch Information
No vendor patch is referenced in the NVD advisory at the time of publication. Monitor the GitHub OpenAtlas Repository for upstream fixes and apply any security releases that supersede version 8.9.0. Coordinate with ACDH-CH for an authoritative remediation timeline.
Workarounds
- Place OpenAtlas behind a reverse proxy that strips or encodes HTML metacharacters in request bodies
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources
- Set the HttpOnly and Secure attributes on session cookies to limit theft via JavaScript
- Reduce the number of accounts with insert privileges until a vendor patch is available
# Example CSP response header to limit XSS impact
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'
Set-Cookie: session=<value>; HttpOnly; Secure; SameSite=Strict
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
