CVE-2025-48368: Group-Office DOM-Based XSS Vulnerability

CVE-2025-48368 Overview

CVE-2025-48368 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Intermesh Group-Office, an enterprise customer relationship management (CRM) and groupware application. The flaw affects versions prior to 6.8.119 and 25.0.20. Attackers can inject crafted payloads into a parameter that the application later processes unsafely in the Document Object Model (DOM), causing arbitrary JavaScript execution in the victim's browser. Successful exploitation can result in session hijacking, page defacement, or redirection to attacker-controlled sites. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation and requires user interaction to trigger.

Critical Impact
Attackers can execute arbitrary JavaScript in an authenticated user's browser session, enabling session hijacking, credential theft, and unauthorized actions within Group-Office.

Affected Products

Intermesh Group-Office versions prior to 6.8.119
Intermesh Group-Office versions prior to 25.0.20
Deployments exposing the Group-Office web interface to untrusted networks

Discovery Timeline

2025-05-22 - CVE-2025-48368 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48368

Vulnerability Analysis

CVE-2025-48368 is a client-side injection flaw where user-controlled input flows into a DOM sink without proper neutralization. Unlike reflected or stored XSS, the payload never needs to reach server-side templating. Instead, client-side JavaScript reads attacker-controlled data from a source such as a URL parameter and writes it into the DOM using an unsafe API. The resulting script executes with the origin and privileges of the Group-Office application, giving the attacker access to session cookies, CSRF tokens, and the authenticated user interface. Because Group-Office is a groupware platform, compromised sessions can expose email, contacts, calendars, and file storage belonging to the victim.

Root Cause

The root cause is improper output encoding when client-side code processes a request parameter and inserts it into the DOM. Sinks that accept HTML or JavaScript content, such as innerHTML assignments, document.write calls, or eval-like constructs, execute injected markup instead of treating it as inert text. The vendor's fix, released in Group-Office 6.8.119 and 25.0.20, applies proper sanitization or safe DOM APIs to the affected code path.

Attack Vector

Exploitation requires an attacker to deliver a crafted URL to an authenticated Group-Office user, typically through phishing, chat messages, or an attacker-controlled page. When the victim clicks the link, the malicious parameter is processed by the vulnerable client-side script and the injected JavaScript executes in the Group-Office origin. No prior authentication or privileges are required from the attacker, but user interaction is mandatory. The vendor advisory at GHSA-c49j-qvp9-vgg6 documents the affected parameter and fix. No public proof-of-concept or exploit code is currently available.

Detection Methods for CVE-2025-48368

Indicators of Compromise

HTTP requests to Group-Office endpoints containing script fragments such as <script>, javascript:, onerror=, or onload= in query string parameters
Outbound browser requests from user workstations to unfamiliar domains immediately after loading a Group-Office URL
Anomalous session activity in Group-Office audit logs, including actions performed without corresponding user navigation events
Emails or chat messages delivering Group-Office links with encoded or obfuscated parameter values

Detection Strategies

Inspect web server and reverse proxy logs for Group-Office requests containing HTML entities, URL-encoded angle brackets, or common XSS keywords in parameters
Enable and monitor Content Security Policy (CSP) violation reports for the Group-Office origin to catch inline script execution attempts
Correlate proxy logs with endpoint telemetry to identify browser sessions loading Group-Office URLs with suspicious query strings
Review Group-Office access logs for authenticated actions originating from unexpected IP addresses or user agents

Monitoring Recommendations

Alert on inbound email or messaging that contains Group-Office URLs with encoded script payloads
Track browser process telemetry for child processes or outbound connections spawned during Group-Office sessions
Monitor for privileged Group-Office accounts accessing links delivered from external sources
Baseline normal parameter values used against Group-Office endpoints and flag statistical outliers

How to Mitigate CVE-2025-48368

Immediate Actions Required

Upgrade Group-Office to version 6.8.119 or 25.0.20 or later without delay
Inventory all Group-Office instances, including staging and legacy deployments, and confirm patch status
Invalidate active user sessions after patching to force re-authentication and clear any hijacked tokens
Communicate the risk to users and instruct them to avoid clicking Group-Office links from untrusted sources until the upgrade completes

Patch Information

Intermesh released fixes in Group-Office 6.8.119 and 25.0.20. Administrators should apply the update per the vendor's guidance in the GitHub Security Advisory GHSA-c49j-qvp9-vgg6. Verify the installed version through the application settings or by inspecting the release manifest after upgrade.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Place Group-Office behind a Web Application Firewall (WAF) with rules that block common XSS payload patterns in query parameters
Restrict Group-Office access to authenticated VPN users to reduce exposure until patches are applied
Train users to recognize suspicious links and report phishing attempts targeting Group-Office sessions

bash

# Example CSP header for Group-Office reverse proxy (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;