CVE-2025-40708: Craws Openatlas XSS Vulnerability

CVE-2025-40708 Overview

CVE-2025-40708 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting OpenAtlas version 8.9.0, developed by the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH). The flaw stems from inadequate validation of user input during POST requests to the /insert/event endpoint, specifically through the name parameter. An authenticated attacker can inject crafted JavaScript payloads that execute in the browser context of another authenticated user. Successful exploitation enables session cookie theft and impersonation of the targeted user within the application.

Critical Impact
Authenticated attackers can inject persistent JavaScript into OpenAtlas event records, enabling session hijacking and unauthorized actions on behalf of victim users.

Affected Products

OpenAtlas 8.9.0 (ACDH-CH / craws)
Deployments exposing the /insert/event endpoint to low-privileged users
Multi-user research environments running the affected OpenAtlas release

Discovery Timeline

2025-08-29 - CVE-2025-40708 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40708

Vulnerability Analysis

The vulnerability resides in the OpenAtlas event creation workflow. When a user submits a POST request to /insert/event, the application stores the name parameter without applying proper input validation or output encoding. The stored value is subsequently rendered to other authenticated users viewing the event record. This creates a stored XSS condition where injected script content executes within the victim's authenticated session context.

An attacker requires valid authentication with permission to create event records. The attack succeeds when a victim user with an active session views the attacker-controlled event. User interaction is required, which aligns with the CVSS 4.0 vector indicating passive user involvement.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. OpenAtlas accepts user-supplied values for the name field in event creation without sanitizing HTML control characters or encoding output when the data is later rendered in the application UI. The absence of a Content Security Policy restrictive enough to block inline script execution compounds the issue.

Attack Vector

Exploitation occurs over the network. An authenticated attacker crafts a POST request to /insert/event with a malicious payload embedded in the name parameter. When another authenticated user, typically an administrator or researcher, loads the affected event view, the payload executes in their browser. The attacker can exfiltrate session cookies, perform actions as the victim, or redirect the user to attacker-controlled infrastructure.

See the INCIBE Security Notice on XSS in OpenAtlas for the vendor-coordinated disclosure details and the OpenAtlas GitHub repository for source code and release information.

Detection Methods for CVE-2025-40708

Indicators of Compromise

POST requests to /insert/event containing HTML tags such as <script>, <img, <svg, or event handler attributes like onerror= and onload= in the name parameter.
Unexpected outbound HTTP requests from browsers of authenticated OpenAtlas users to unknown domains shortly after loading event records.
Session cookie reuse from unexpected IP addresses or user agents following OpenAtlas activity.

Detection Strategies

Inspect web server and application logs for POST requests to /insert/event with non-alphanumeric payloads in the name field.
Deploy a web application firewall ruleset that flags XSS payload signatures in form submissions to OpenAtlas endpoints.
Review database records for stored event names containing HTML or JavaScript syntax that should not appear in legitimate research data.

Monitoring Recommendations

Enable verbose request logging for all /insert/* and /update/* OpenAtlas endpoints and forward logs to a centralized analytics platform.
Alert on anomalous authentication patterns, including sessions reused from distinct geolocations within short time windows.
Monitor browser Content Security Policy violation reports if CSP enforcement is enabled on the OpenAtlas deployment.

How to Mitigate CVE-2025-40708

Immediate Actions Required

Upgrade OpenAtlas to a release later than 8.9.0 once the vendor publishes a patched version.
Restrict event creation permissions to trusted user accounts until the fix is applied.
Rotate active session cookies and force reauthentication for all OpenAtlas users as a precaution.

Patch Information

At the time of publication, no vendor advisory URL was included in the NVD record. Administrators should monitor the OpenAtlas GitHub repository for release notes addressing CVE-2025-40708 and apply updates as they become available.

Workarounds

Deploy a reverse proxy or web application firewall rule that strips or encodes HTML metacharacters in the name parameter of /insert/event requests.
Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to the application origin.
Limit which user roles can create or edit event records to reduce the exposure window for stored XSS payloads.

bash

# Example NGINX ModSecurity rule to block suspicious payloads in the name parameter
SecRule ARGS:name "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1040708,phase:2,deny,status:403,msg:'Potential XSS targeting OpenAtlas CVE-2025-40708'"