CVE-2025-48993: Intermesh Group-office XSS Vulnerability

CVE-2025-48993 Overview

CVE-2025-48993 is a reflected cross-site scripting (XSS) vulnerability affecting Intermesh Group-Office, an enterprise customer relationship management (CRM) and groupware application. The flaw resides in the Look and Feel formatting input fields, where the web application fails to sanitize user-supplied content before rendering it in the browser. Any authenticated user can update these fields and inject a malicious JavaScript payload. When the payload renders, it executes in the context of the victim's session. The issue is tracked as [CWE-79] and is patched in versions 6.8.123 and 25.0.27.

Critical Impact

Authenticated attackers can inject JavaScript that executes in another user's browser session, enabling session data theft, unauthorized actions, and interface manipulation within Group-Office.

Affected Products

• Intermesh Group-Office versions prior to 6.8.123
• Intermesh Group-Office versions prior to 25.0.27
• Group-Office Look and Feel formatting input handler

Discovery Timeline

• 2025-06-17 - CVE-2025-48993 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48993

Vulnerability Analysis

Group-Office exposes user-editable Look and Feel formatting fields through the account settings interface. The application persists these values and later renders them in the web UI without applying HTML encoding. When a payload containing HTML or JavaScript is stored and reflected back, the browser interprets it as executable content. An authenticated user who submits crafted input can cause script execution in the session of any user who triggers the vulnerable rendering path. The impact includes unauthorized actions, interface tampering, and disclosure of session-bound data accessible from the DOM.

Root Cause

The root cause is missing output encoding in the ExtJS-based rendering logic for multi-select field values in www/go/core/views/extjs3/form/multiselect/Field.js. The renderer returned raw entity display values directly to the DOM, allowing HTML markup and inline event handlers to be interpreted by the browser. This is a classic instance of improper neutralization of input during web page generation [CWE-79].

Attack Vector

Exploitation requires network access to the Group-Office web interface and low-privilege authenticated access. An attacker updates their own Look and Feel formatting values with a JavaScript payload. When the vulnerable renderer displays the value, the payload executes in the browser context of the viewing user. The upstream patches introduce Ext.util.Format.htmlEncode() around the returned value, converting HTML control characters into their encoded equivalents.

// Patch diff from www/go/core/views/extjs3/form/multiselect/Field.js
            dataIndex: config.idField,
            renderer: function (id, meta, record) {
                //must be preloaded
-               return me.entities[id][me.displayField];
+               return Ext.util.Format.htmlEncode(me.entities[id][me.displayField]);
            }
// Source: https://github.com/Intermesh/groupoffice/commit/1e2a2450f204174f87a93217838d74718996dcdd

Detection Methods for CVE-2025-48993

Indicators of Compromise

• Look and Feel formatting field values containing <script>, onerror=, onload=, javascript:, or encoded variants stored in the Group-Office database.
• HTTP requests to Group-Office account settings endpoints containing HTML tags or event handler attributes in form parameters.
• Anomalous outbound requests originating from authenticated Group-Office user sessions to attacker-controlled hosts.

Detection Strategies

• Inspect stored user profile records for HTML markup in fields that should contain plain text formatting values.
• Deploy web application firewall (WAF) rules that flag XSS payload patterns targeting Group-Office /api/ and account settings paths.
• Correlate browser console errors and Content Security Policy (CSP) violation reports with the affected rendering paths.

Monitoring Recommendations

• Log all mutations to Look and Feel formatting fields with the submitting user, source IP, and payload length.
• Alert on authenticated sessions performing DOM-triggered outbound requests to previously unseen domains.
• Track deployed Group-Office versions across the environment and flag hosts running builds prior to 6.8.123 or 25.0.27.

How to Mitigate CVE-2025-48993

Immediate Actions Required

• Upgrade Group-Office to version 6.8.123 or 25.0.27 or later.
• Audit existing user profile records for previously stored payloads and sanitize or reset affected fields.
• Rotate active session tokens for users whose profile data contained suspicious content.

Patch Information

Intermesh released fixes in Group-Office 6.8.123 and 25.0.27. The upstream commits apply Ext.util.Format.htmlEncode() in the multi-select renderer. Review the GitHub Security Advisory GHSA-xv2x-v374-92gv, the initial commit, and the follow-up commit.

Workarounds

• Enforce a strict Content Security Policy (CSP) that blocks inline script execution on the Group-Office origin.
• Restrict access to Group-Office to trusted networks or via VPN until patching is complete.
• Educate users to avoid pasting untrusted content into Look and Feel formatting fields.

# Example nginx CSP header to reduce XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;