CVE-2025-54859: desknet's NEO Stored XSS Vulnerability

CVE-2025-54859 Overview

CVE-2025-54859 is a stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier. The flaw allows an authenticated attacker with high privileges to inject arbitrary JavaScript that executes in another user's browser session. The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Exploitation requires user interaction, such as viewing the affected page. Successful attacks can lead to session data disclosure, unauthorized actions performed under the victim's identity, or defacement of content rendered within the application.

Critical Impact
Attackers with authenticated access can persist malicious JavaScript that executes when other users load the affected page, enabling session abuse and content tampering.

Affected Products

desknet's NEO V9.0R2.0
desknet's NEO V9.0 earlier releases
Deployments that have not applied the vendor maintenance update

Discovery Timeline

2025-10-16 - CVE-2025-54859 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54859

Vulnerability Analysis

The vulnerability is a stored XSS issue in desknet's NEO, a Japanese groupware platform. Input submitted through an affected feature is stored server-side and later rendered without sufficient output encoding. When another user views the injected content, the browser executes the attacker-controlled JavaScript in the context of the application origin.

Exploitation requires an authenticated session with elevated privileges and interaction from a victim user. The impact is limited to confidentiality and integrity of the browser-rendered content within a subsequent security scope, with no direct effect on the underlying host.

Root Cause

The root cause is improper neutralization of user-supplied input before it is written into HTML output. The application accepts data through an authenticated interface, stores it, and later reflects it into a page without HTML entity encoding or context-aware sanitization. This allows script tags or event handler attributes to survive to the DOM.

Attack Vector

The attack vector is network-based and requires a privileged account. The attacker submits a crafted payload through an input field that persists to storage. A victim user, typically another authenticated user, later loads the page containing the payload. The script then executes with the same origin as the desknet's NEO application, giving it access to session-scoped resources and DOM content.

No public proof-of-concept, exploit code, or CISA KEV listing is associated with CVE-2025-54859 at this time. See the JVN Security Advisory JVN90757550 for coordinated disclosure details.

Detection Methods for CVE-2025-54859

Indicators of Compromise

Stored records in desknet's NEO containing <script>, onerror=, onload=, or javascript: sequences in user-submitted fields.
Web server logs showing POST requests with HTML or JavaScript payloads to authenticated desknet's NEO endpoints.
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after loading desknet's NEO pages.

Detection Strategies

Review application and database records for HTML tags or event handlers stored in fields intended for plain text.
Deploy a web application firewall (WAF) rule set that flags XSS payload patterns targeting the desknet's NEO URL paths.
Enable browser-side reporting through a Content Security Policy (CSP) report-uri or report-to directive to surface script violations.

Monitoring Recommendations

Monitor authenticated user activity for accounts submitting content containing HTML markup outside expected use cases.
Alert on anomalous script execution or DOM manipulation reported by CSP violation endpoints tied to desknet's NEO hostnames.
Correlate privileged account logins with subsequent stored-content modifications to identify suspicious sequences.

How to Mitigate CVE-2025-54859

Immediate Actions Required

Upgrade desknet's NEO to a version later than V9.0R2.0 that includes the vendor's XSS fix.
Audit stored content for injected script payloads and remove or sanitize any offending records.
Rotate credentials and session tokens for privileged accounts if injection activity is suspected.

Patch Information

NeoJapan has published maintenance guidance for desknet's NEO addressing this issue. Administrators should follow the vendor instructions in the Desknets Maintenance Support Document and the coordinated advisory at JVN90757550 to obtain and apply the fixed release.

Workarounds

Restrict which accounts hold the elevated privileges required to reach the vulnerable input, reducing the pool of potential attackers.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on desknet's NEO pages.
Deploy WAF signatures to block common XSS payload patterns on requests to the affected application endpoints.

bash

# Example Content Security Policy header to reduce XSS impact
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report