CVE-2025-55056: Maxum Rumpus XSS Vulnerability

CVE-2025-55056 Overview

CVE-2025-55056 is a Cross-Site Scripting (XSS) vulnerability affecting Maxum Rumpus, a macOS-based file transfer and web server product. The flaw stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. An attacker can craft malicious input that executes arbitrary script in the browser of a user who interacts with the affected interface. The vulnerability requires user interaction and can cross security scopes, allowing attackers to target authenticated sessions and steal credentials or session tokens.

Critical Impact
Successful exploitation enables attackers to execute arbitrary JavaScript in victim browsers, hijack authenticated sessions, and perform actions on behalf of Rumpus users.

Affected Products

Maxum Rumpus 9.0.12
Maxum Rumpus web administration and file management interfaces
Deployments exposing Rumpus web components to untrusted users

Discovery Timeline

2025-11-17 - CVE-2025-55056 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55056

Vulnerability Analysis

CVE-2025-55056 covers multiple instances of improper input neutralization within Maxum Rumpus web page generation logic. The application accepts user-controlled input and reflects or stores it in HTML output without sufficient encoding or sanitization. When a victim renders the affected page, the injected script executes in the security context of the Rumpus web application. Because the vulnerability changes the security scope, an unauthenticated attacker can influence content that later renders in an authenticated administrator or user session. This is a client-side execution flaw. It does not directly grant server-side code execution, but it enables session theft, credential harvesting through injected forms, and unauthorized actions issued from the victim's browser.

Root Cause

The root cause is missing or insufficient output encoding when Rumpus generates HTML from parameters supplied through HTTP requests. Input that should be treated as data is rendered as active content, allowing <script> tags, event handlers, and JavaScript URIs to execute.

Attack Vector

Exploitation is network-based and requires the victim to interact with a crafted link or attacker-controlled page. The attacker delivers a URL containing an XSS payload targeting a vulnerable Rumpus endpoint. When the victim, typically an authenticated Rumpus user or administrator, opens the link, the injected script runs against the Rumpus origin and can access cookies, tokens, and DOM data accessible to that origin.

No verified proof-of-concept code has been published. See the Israeli Government CVE Advisories for additional technical detail.

Detection Methods for CVE-2025-55056

Indicators of Compromise

HTTP requests to Rumpus endpoints containing script tags, javascript: URIs, or common XSS payload patterns such as onerror=, onload=, or <img src=x>.
Web server access logs showing encoded payloads (%3Cscript%3E, %3Cimg) in query strings or form fields directed at Rumpus.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after Rumpus interaction.

Detection Strategies

Deploy web application firewall rules that inspect parameters submitted to Rumpus endpoints for HTML and JavaScript metacharacters.
Correlate referrer headers and query strings across Rumpus sessions to identify reflected payloads followed by administrator activity.
Enable browser Content Security Policy (CSP) reporting to capture blocked inline script execution originating from Rumpus pages.

Monitoring Recommendations

Ingest Rumpus web server logs into a centralized logging platform and alert on high-entropy or script-like tokens in request parameters.
Monitor authenticated administrator sessions for unusual sequences of actions initiated immediately after clicking external links.
Track cookie access anomalies and session token reuse from unexpected IP addresses.

How to Mitigate CVE-2025-55056

Immediate Actions Required

Identify all Maxum Rumpus deployments running version 9.0.12 and inventory their exposure to the public internet.
Restrict Rumpus web administration interfaces to trusted networks or VPN access until a patch is applied.
Instruct administrators and privileged users to avoid clicking untrusted links that reference the Rumpus host.

Patch Information

Consult Maxum for a fixed release addressing CVE-2025-55056. Apply the vendor-supplied update as soon as it becomes available. Until then, treat the affected version as vulnerable and apply compensating controls. Reference the Israeli Government CVE Advisories for advisory tracking.

Workarounds

Place Rumpus behind a reverse proxy or WAF configured to strip or block HTML and JavaScript payloads in request parameters.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to known origins.
Set the HttpOnly and Secure flags on Rumpus session cookies to reduce token theft impact.
Segment administrator workstations and require dedicated browsers or profiles for Rumpus management tasks.

bash

# Example nginx reverse-proxy header hardening in front of Rumpus
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "no-referrer" always;
proxy_cookie_flags ~ HttpOnly Secure SameSite=Strict;