CVE-2025-40709: OpenAtlas XSS Vulnerability

CVE-2025-40709 Overview

CVE-2025-40709 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in OpenAtlas version 8.9.0, developed by the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH). The flaw stems from inadequate validation of user input submitted through POST requests to the /insert/person/<ID> endpoint. Attackers can inject malicious payloads via the name and alias-0 parameters. A remote authenticated user can craft requests targeting another authenticated user to steal session cookies. The vulnerability was published to the National Vulnerability Database (NVD) on August 29, 2025.

Critical Impact
Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser session, leading to session cookie theft and account takeover within the OpenAtlas application.

Affected Products

OpenAtlas 8.9.0 (Austrian Centre for Digital Humanities and Cultural Heritage)
Component: craws:openatlas
CPE: cpe:2.3:a:craws:openatlas:8.9.0:*:*:*:*:*:*:*

Discovery Timeline

2025-08-29 - CVE-2025-40709 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40709

Vulnerability Analysis

OpenAtlas is an open-source web application used by researchers to manage historical, archaeological, and cultural heritage data. The vulnerability exists in the person record creation workflow accessible at /insert/person/<ID>. The application accepts POST parameters name and alias-0 without applying sufficient output encoding or input sanitization. Attacker-supplied HTML or JavaScript content is stored server-side and rendered in subsequent page views. When an authenticated victim views the affected record, the injected script executes in their browser context.

Root Cause

The root cause is missing or insufficient neutralization of user-controlled input during web page generation [CWE-79]. The name and alias-0 fields on the person insertion form are not properly encoded before being reflected back into HTML responses. This allows attacker-supplied markup and script tags to be interpreted by the browser rather than treated as literal text.

Attack Vector

Exploitation requires network access to the OpenAtlas instance and a low-privileged authenticated account. The attacker submits a crafted POST request containing a JavaScript payload in the name or alias-0 parameter. User interaction is required, as a second authenticated user must visit the affected page for the payload to fire. Once triggered, the script runs with the victim's session privileges and can exfiltrate document.cookie, perform actions on behalf of the victim, or pivot to other application functionality.

No verified public proof-of-concept code is available. Refer to the INCIBE Security Notice on XSS for further technical context.

Detection Methods for CVE-2025-40709

Indicators of Compromise

HTTP POST requests to /insert/person/<ID> containing script tags, event handler attributes such as onerror= or onload=, or javascript: URIs in the name or alias-0 parameters.
Outbound requests from user browsers to unfamiliar domains shortly after loading OpenAtlas person records, potentially indicating cookie exfiltration.
Stored OpenAtlas person entries containing HTML markup or encoded script payloads in name or alias-0 fields.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST bodies to OpenAtlas endpoints for XSS signatures including <script, onerror=, onload=, and javascript:.
Review OpenAtlas application logs for POST requests to /insert/person/ and /update/person/ endpoints with anomalous parameter lengths or non-alphanumeric content in name fields.
Query stored database records for person entries containing HTML tags or JavaScript keywords in text fields intended for plain names.

Monitoring Recommendations

Enable verbose HTTP request logging on the OpenAtlas web tier and forward logs to a centralized SIEM for correlation.
Monitor authenticated session activity for unusual concurrent access patterns that may indicate session hijacking.
Alert on new or modified person records created by low-privileged accounts that contain suspicious content in indexed name fields.

How to Mitigate CVE-2025-40709

Immediate Actions Required

Restrict access to the OpenAtlas application to trusted networks or through a VPN until a patched version is deployed.
Audit user accounts and revoke access for unnecessary or dormant accounts to reduce the pool of potential attackers.
Review stored person records in OpenAtlas for existing malicious payloads and sanitize or remove affected entries.

Patch Information

Monitor the GitHub OpenAtlas Repository for updates and security releases addressing this issue. At the time of publication, users should upgrade beyond version 8.9.0 once a fixed release is available from ACDH-CH. Refer to the INCIBE Security Notice on XSS for coordinated advisory details.

Workarounds

Deploy a WAF in front of OpenAtlas with rules blocking XSS payloads targeting the /insert/person/<ID> endpoint and its name and alias-0 parameters.
Configure a strict Content Security Policy (CSP) response header that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and Secure attributes on session cookies to reduce the impact of successful script execution and prevent cookie theft via document.cookie.

bash

# Example nginx configuration to add security headers in front of OpenAtlas
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;