CVE-2025-52180: Zucchetti Ad Hoc Infinity XSS Vulnerability

CVE-2025-52180 Overview

CVE-2025-52180 is a reflected cross-site scripting (XSS) vulnerability affecting Zucchetti Ad Hoc Infinity version 4.2 and earlier. The flaw resides in the /ahi/jsp/gsfr_feditorHTML.jsp endpoint, which fails to sanitize the pHtmlSource parameter before rendering it in the response. Remote unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser session when the victim opens a crafted URL. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the context of an authenticated user's session, enabling session theft, credential harvesting, and unauthorized actions within the Ad Hoc Infinity application.

Affected Products

Zucchetti Ad Hoc Infinity 4.2
Zucchetti Ad Hoc Infinity versions prior to 4.2
Deployments exposing the /ahi/jsp/gsfr_feditorHTML.jsp endpoint

Discovery Timeline

2025-10-30 - CVE-2025-52180 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52180

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the HTML editor JSP page shipped with Ad Hoc Infinity. The endpoint /ahi/jsp/gsfr_feditorHTML.jsp accepts a pHtmlSource query parameter and reflects its value directly into the HTML response. Because the application does not encode or filter the parameter, an attacker-controlled payload is parsed and executed by the victim's browser.

Exploitation requires user interaction, typically clicking a crafted link. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component, including cookies and DOM state within the application's origin. Successful exploitation compromises confidentiality and integrity of the user's session, but does not directly impact availability.

Root Cause

The root cause is missing output encoding on the pHtmlSource parameter within gsfr_feditorHTML.jsp. The JSP writes the raw parameter value into an HTML context without applying HTML entity encoding or a content sanitizer, allowing <script> tags and event handler attributes to be interpreted as executable markup.

Attack Vector

An attacker crafts a URL targeting the vulnerable endpoint with a malicious pHtmlSource value and delivers it through phishing, malicious advertisements, or embedded links on third-party sites. When an authenticated Ad Hoc Infinity user opens the URL, the JavaScript executes with the privileges of that user's session. Public proof-of-concept details are referenced in the GitHub Gist Exploit Code.

No verified exploitation code is reproduced here. The exploit takes the general form of appending a script payload to the pHtmlSource query string parameter of the affected JSP endpoint.

Detection Methods for CVE-2025-52180

Indicators of Compromise

HTTP requests to /ahi/jsp/gsfr_feditorHTML.jsp containing pHtmlSource values with <script, javascript:, onerror=, or onload= substrings.
Referer headers pointing to untrusted external domains for requests hitting the affected JSP.
Web server access logs showing URL-encoded payloads such as %3Cscript%3E in the pHtmlSource parameter.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag reflected XSS patterns in the pHtmlSource query parameter.
Correlate authenticated user sessions with anomalous outbound requests originating from browser sessions to detect exfiltration triggered by injected scripts.
Review historical proxy and web server logs for the /ahi/jsp/gsfr_feditorHTML.jsp path with suspicious query strings.

Monitoring Recommendations

Alert on any inbound request to the Ad Hoc Infinity gsfr_feditorHTML.jsp endpoint with non-alphanumeric characters in pHtmlSource.
Monitor for spikes in session cookie usage from atypical geolocations following user access to the vulnerable endpoint.
Enable Content Security Policy (CSP) violation reporting to identify blocked inline script attempts.

How to Mitigate CVE-2025-52180

Immediate Actions Required

Restrict external access to the /ahi/jsp/gsfr_feditorHTML.jsp endpoint via network controls or reverse proxy rules until a vendor patch is applied.
Contact Zucchetti support through the Zucchetti Security Information portal to obtain the fixed release for Ad Hoc Infinity.
Educate users to avoid clicking untrusted links referencing the Ad Hoc Infinity application.

Patch Information

At the time of publication, no vendor advisory URL or patched version identifier is documented in the NVD entry. Administrators should engage Zucchetti directly for a version newer than 4.2 that addresses the pHtmlSource parameter handling in gsfr_feditorHTML.jsp.

Workarounds

Deploy a WAF rule that blocks or sanitizes requests containing HTML tags or JavaScript event handlers in the pHtmlSource parameter.
Enforce a strict Content Security Policy that disallows inline scripts (script-src 'self') to reduce the impact of reflected XSS.
Set the HttpOnly and Secure flags on session cookies to limit script-based session theft.
Configure the SameSite=Strict cookie attribute to reduce cross-site request effectiveness.

bash

# Example NGINX rule blocking XSS payloads in the vulnerable parameter
location /ahi/jsp/gsfr_feditorHTML.jsp {
    if ($arg_pHtmlSource ~* "(<script|javascript:|onerror=|onload=|%3Cscript)") {
        return 403;
    }
    proxy_pass http://ad_hoc_infinity_backend;
}