CVE-2025-54760: desknet's NEO Stored XSS Vulnerability

CVE-2025-54760 Overview

CVE-2025-54760 is a stored cross-site scripting (XSS) vulnerability affecting desknet's NEO V9.0R2.0 and earlier versions. The flaw allows an authenticated attacker to inject arbitrary JavaScript that executes in the browser of any user who views the affected content. desknet's NEO is a Japanese enterprise groupware platform used for scheduling, messaging, and workflow. The vulnerability is tracked under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can store malicious JavaScript that executes in other users' browsers, enabling session context abuse, UI redress, and content manipulation within the groupware application.

Affected Products

desknet's NEO V9.0R2.0
desknet's NEO versions earlier than V9.0R2.0
Deployments on-premises and hosted instances running affected builds

Discovery Timeline

2025-10-16 - CVE-2025-54760 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54760

Vulnerability Analysis

The vulnerability is a stored XSS issue in desknet's NEO V9. User-supplied input is persisted by the application and later rendered in another user's browser without adequate output encoding or sanitization. When the tainted content is loaded, the browser parses attacker-controlled markup as executable JavaScript in the origin of the groupware application.

Exploitation requires the attacker to hold a low-privilege authenticated account and requires a victim to view the affected content. Because the payload is stored server-side, a single injection can affect any user who subsequently loads the page. The impact is scoped to the confidentiality and integrity of downstream browser sessions rather than the underlying server.

Root Cause

The root cause is improper neutralization of user input during web page generation [CWE-79]. Input fields in desknet's NEO V9 accept HTML or JavaScript constructs and store them without applying context-aware escaping when the data is rendered. The absence of consistent output encoding on the affected fields allows script tags, event handlers, or similar constructs to reach the DOM intact.

Attack Vector

An authenticated attacker submits crafted input to a vulnerable field within desknet's NEO. The payload is saved to the application's data store. When another authenticated user opens the page containing that data, the payload executes in the victim's browser under the application's origin. Attackers can use this position to read DOM content, perform actions on behalf of the victim, or redirect the browser to attacker-controlled infrastructure.

No verified proof-of-concept code has been published. See the JVN Security Advisory JVN90757550 for advisory details.

Detection Methods for CVE-2025-54760

Indicators of Compromise

Stored records within desknet's NEO containing <script>, javascript: URIs, or inline event handlers such as onerror= or onload=
HTTP POST or PUT requests to desknet's NEO endpoints carrying HTML-encoded payloads in fields that normally hold plain text
Browser console errors or unexpected outbound requests observed when users view specific groupware pages

Detection Strategies

Review application and web server logs for form submissions that contain markup or script fragments in user-content fields
Inspect stored records in the desknet's NEO database for content that violates expected data types or encoding
Deploy a Content Security Policy (CSP) in report-only mode to surface script execution from unexpected sources

Monitoring Recommendations

Alert on outbound browser traffic from client sessions to unrecognized domains shortly after loading groupware pages
Monitor authentication events for accounts that recently modified shared content followed by unusual session activity from other users
Track requests to the affected application for anomalies in payload size or character distribution consistent with script injection

How to Mitigate CVE-2025-54760

Immediate Actions Required

Upgrade desknet's NEO to the fixed release identified in the vendor's Desknets Maintenance Information
Audit existing records for stored payloads and remove or sanitize any content containing script constructs
Rotate session tokens for users who may have viewed attacker-controlled content prior to remediation

Patch Information

NeoJapan has published maintenance information addressing this issue. Administrators should apply the update referenced in the Desknets Maintenance Information and confirm the deployed build is later than V9.0R2.0. The JVN Security Advisory JVN90757550 provides coordinated disclosure details.

Workarounds

Restrict access to the affected application to trusted network segments until patching is complete
Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to known origins
Limit low-privilege user permissions on fields that render to other users, reducing the population of accounts capable of injecting content

bash

# Example Content-Security-Policy header for the reverse proxy fronting desknet's NEO
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;