CVE-2025-52614: HCLTech Unica XSS Vulnerability

CVE-2025-52614 Overview

CVE-2025-52614 affects the HCL Unica Platform, a marketing automation suite from HCL Technologies. The vulnerability stems from session cookies issued without the HttpOnly flag set. Without this flag, client-side scripts can read cookie values through the Document Object Model (DOM). An attacker who chains this weakness with a Cross-Site Scripting (XSS) vector or a malicious link can extract authenticated session identifiers. The issue is tracked under CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute family, covering missing cookie protection attributes.

Critical Impact
Successful exploitation allows attackers to read session cookies via client-side script, enabling session hijacking and unauthorized access to authenticated Unica Platform sessions.

Affected Products

HCL Unica Platform (all versions prior to the vendor-supplied fix)
Component identifier: hcltech:unica
Deployments exposing the Unica web interface to end users

Discovery Timeline

2025-10-12 - CVE-2025-52614 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52614

Vulnerability Analysis

The HCL Unica Platform issues one or more cookies without the HttpOnly attribute in the Set-Cookie response header. The HttpOnly attribute instructs browsers to restrict cookie access to HTTP or HTTPS requests only. When the flag is absent, any JavaScript executing in the same origin can read the cookie through document.cookie. This defeats a key defense-in-depth control against session theft during XSS exploitation.

The vulnerability requires user interaction. An attacker must lure an authenticated Unica user to a crafted link or malicious page that triggers script execution against the Unica origin. The confidentiality impact is limited to session data, with no direct integrity or availability effect.

Root Cause

The root cause is a missing security attribute during cookie generation on the server side. The application does not append HttpOnly (and potentially Secure and SameSite) attributes when constructing session cookies. This is a configuration and design flaw classified as [CWE-614].

Attack Vector

An attacker delivers a crafted link or embeds malicious content on a third-party site. When an authenticated Unica user follows the link, script executing in the Unica origin reads document.cookie and exfiltrates the value to an attacker-controlled endpoint. The attacker then replays the captured cookie to impersonate the victim within the Unica Platform.

No verified proof-of-concept code is available for this issue. Refer to the HCL Software Knowledge Base Article for vendor technical details.

Detection Methods for CVE-2025-52614

Indicators of Compromise

Outbound HTTP or HTTPS requests from browser sessions containing session cookie values in query strings, referrers, or POST bodies to non-Unica domains
Multiple concurrent Unica Platform sessions originating from geographically distinct IP addresses under a single user account
Anomalous authenticated activity from user agents or devices not previously associated with the account

Detection Strategies

Inspect Set-Cookie response headers from Unica endpoints to confirm whether HttpOnly is present on session cookies
Correlate web proxy logs for outbound traffic containing strings matching known Unica cookie names
Monitor web application firewall (WAF) logs for reflected or stored payloads targeting the Unica origin

Monitoring Recommendations

Enable session anomaly detection to flag concurrent sessions from disparate IP addresses or ASNs
Log and alert on requests to /unica/* paths that contain suspicious query parameters or script fragments
Retain HTTP request and response headers for the Unica application to support forensic review

How to Mitigate CVE-2025-52614

Immediate Actions Required

Apply the patch or configuration guidance published in the HCL Software Knowledge Base Article
Force invalidation of active Unica Platform sessions after applying the fix to eliminate previously issued vulnerable cookies
Review authentication logs for unauthorized session reuse predating the patch deployment

Patch Information

HCL Software has published remediation guidance in knowledge base article KB0124417. Administrators should apply the referenced update or configuration change to ensure session cookies are issued with the HttpOnly attribute. Verify the fix by inspecting the Set-Cookie response header on authenticated Unica sessions.

Workarounds

Deploy a reverse proxy or WAF rule that rewrites Set-Cookie headers to append HttpOnly, Secure, and SameSite=Strict attributes
Enforce short session timeouts to reduce the window in which a stolen cookie remains valid
Restrict Unica Platform access to trusted networks or VPN clients until the patch is applied

bash

# Example NGINX reverse proxy directive to enforce HttpOnly on upstream cookies
proxy_cookie_flags ~ httponly secure samesite=strict;