CVE-2025-52204: Znuny::ITSM XSS Vulnerability

CVE-2025-52204 Overview

A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x that allows attackers to inject malicious scripts through the customer.pl endpoint via the OTRSCustomerInterface parameter. This reflected XSS vulnerability enables attackers to execute arbitrary JavaScript code in the context of a victim's browser session when they interact with a crafted malicious URL.

Critical Impact

Attackers can exploit this XSS vulnerability to steal session cookies, hijack user accounts, redirect users to malicious websites, or perform actions on behalf of authenticated users within the Znuny ITSM help desk system.

Affected Products

• Znuny::ITSM 6.5.x series
• Znuny ITSM deployments using the customer.pl endpoint
• Systems with customer-facing portal interfaces enabled

Discovery Timeline

• 2026-03-23 - CVE CVE-2025-52204 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2025-52204

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in how the Znuny::ITSM application handles user-supplied input through the OTRSCustomerInterface parameter in the customer.pl endpoint.

The vulnerable endpoint fails to properly sanitize or encode user input before reflecting it back in the HTTP response. When a user clicks on a specially crafted link containing malicious JavaScript, the browser executes the injected script in the security context of the Znuny ITSM application, effectively granting the attacker access to the victim's session.

The attack requires user interaction (clicking a malicious link), and the malicious payload is reflected from the URL parameter rather than stored in the application database, classifying this as a reflected XSS vulnerability.

Root Cause

The root cause of this vulnerability is improper input validation and output encoding in the customer.pl script. The OTRSCustomerInterface parameter value is incorporated into the HTML response without adequate sanitization, allowing HTML entities and JavaScript code to be rendered by the victim's browser.

Proper input validation should reject or sanitize special characters such as <, >, ", ', and &. Additionally, context-aware output encoding should be applied before rendering any user-controlled data in HTML, JavaScript, or URL contexts.

Attack Vector

The attack is network-based and requires an attacker to craft a malicious URL containing JavaScript payload in the OTRSCustomerInterface parameter. The attacker must then trick a victim into clicking the link through social engineering techniques such as phishing emails or malicious website redirects.

Upon clicking the crafted link, the victim's browser sends a request to the vulnerable Znuny ITSM server, which reflects the malicious script back in its response. The browser then executes the JavaScript in the context of the authenticated session, potentially allowing the attacker to steal credentials, session tokens, or perform unauthorized actions.

A proof-of-concept demonstrating this vulnerability is available at the GitHub CVE-2025-52204 PoC repository. The vulnerability is exploited through the customer portal interface, making customer-facing deployments particularly at risk.

Detection Methods for CVE-2025-52204

Indicators of Compromise

• Suspicious HTTP requests to customer.pl containing encoded JavaScript or HTML tags in the OTRSCustomerInterface parameter
• Web server logs showing URL patterns with <script>, javascript:, onerror=, or similar XSS payload indicators
• Unusual session activity or account behavior following user interaction with external links
• Reports from users about unexpected redirects or browser behavior when accessing the customer portal

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS patterns in request parameters
• Configure intrusion detection systems to alert on requests containing script tags or event handlers in URL parameters
• Enable detailed logging for the customer.pl endpoint and analyze logs for anomalous parameter values
• Deploy browser-based XSS auditing tools and Content Security Policy (CSP) headers to detect and prevent script injection

Monitoring Recommendations

• Monitor web server access logs for requests to customer.pl with unusually long or encoded OTRSCustomerInterface parameter values
• Set up alerts for multiple failed or suspicious authentication attempts following potential XSS exploitation
• Review network traffic for data exfiltration patterns that may indicate successful session hijacking
• Implement real-time monitoring for CSP violation reports to identify XSS attempts

How to Mitigate CVE-2025-52204

Immediate Actions Required

• Upgrade Znuny ITSM to version 7.3.1 or later, which addresses this vulnerability according to the Znuny Release Notes 7.3.1
• Implement Content Security Policy (CSP) headers to restrict inline script execution and mitigate XSS impact
• Deploy a Web Application Firewall (WAF) with XSS detection rules in front of the Znuny ITSM application
• Educate users about the risks of clicking on suspicious links, particularly those targeting the customer portal

Patch Information

Znuny has released version 7.3.1 which includes security fixes for this vulnerability. Organizations should review the official Znuny Release Notes 7.3.1 for detailed upgrade instructions and changelog information.

Additional information about Znuny products can be found at the Znuny Official Website and Znuny ITSM Official Website.

Workarounds

• Implement strict CSP headers that disable inline JavaScript execution using directives like script-src 'self'
• Configure reverse proxy or WAF rules to sanitize or block requests containing suspicious characters in the OTRSCustomerInterface parameter
• Restrict access to the customer portal to trusted networks or implement additional authentication controls
• Consider temporarily disabling the affected customer portal functionality if immediate patching is not possible

# Example Apache configuration to add Content Security Policy header
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
</IfModule>