CVE-2025-55072: desknet's NEO Stored XSS Vulnerability

CVE-2025-55072 Overview

CVE-2025-55072 is a stored cross-site scripting (XSS) vulnerability affecting desknet's NEO, a Japanese groupware platform. The flaw impacts versions V2.0R1.0 through V9.0R2.0 and allows an authenticated attacker to inject persistent JavaScript payloads. When another user renders the affected content, the browser executes the attacker-controlled script in the victim's session context. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can store malicious JavaScript that executes in any user's browser session, enabling session data theft, unauthorized actions on behalf of the victim, and internal reconnaissance across the groupware platform.

Affected Products

desknet's NEO V2.0R1.0 through V9.0R2.0
Deployments exposing the groupware interface to authenticated users
Environments where multiple users interact with shared content within the application

Discovery Timeline

2025-10-16 - CVE-2025-55072 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55072

Vulnerability Analysis

The vulnerability is a stored XSS flaw in desknet's NEO. Stored XSS occurs when user-supplied input is persisted server-side and later returned to other users without adequate output encoding. An attacker with valid credentials submits a payload containing JavaScript through an input field that the application saves to its data store. When another user loads a page that renders the stored content, the browser executes the injected script under the application's origin.

The scope of impact aligns with typical stored XSS outcomes: theft of session cookies not protected by HttpOnly, forced actions using the victim's privileges, form-based credential harvesting, and pivoting to internal resources reachable from the victim's browser. Because the payload persists on the server, the attack requires no continued attacker interaction after injection.

Root Cause

The root cause is improper neutralization of user input during web page generation [CWE-79]. desknet's NEO fails to sanitize or contextually encode input before storing it and rendering it back into HTML responses. Without HTML entity encoding or a strict Content Security Policy (CSP), attacker-supplied <script> tags or event handler attributes execute in the rendering user's browser.

Attack Vector

Exploitation requires network access to the desknet's NEO instance and low-privilege authenticated access. The attacker submits a crafted payload through an input surface accepted by the application. A separate user must then view the affected page for the injected script to execute, meaning the attack requires victim interaction. Refer to the JVN vulnerability advisory JVN90757550 for reported technical context.

No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-55072

Indicators of Compromise

Stored records within desknet's NEO containing <script>, javascript: URIs, or DOM event handler attributes such as onerror=, onload=, or onmouseover=.
Outbound browser requests from user sessions to unfamiliar external domains shortly after loading groupware pages.
Unexpected authenticated API calls originating from user sessions that align with actions the user did not initiate.

Detection Strategies

Review database fields and content stores in desknet's NEO for HTML tags or JavaScript syntax that should not appear in user-generated text.
Inspect HTTP responses served by the groupware for reflected script markers using a web application firewall or reverse proxy in logging mode.
Correlate authenticated session activity with anomalous outbound connections to identify script-driven data exfiltration attempts.

Monitoring Recommendations

Enable verbose access logging on the desknet's NEO web tier and retain logs for post-incident analysis.
Monitor for CSP violation reports if a Content Security Policy is deployed in front of the application.
Alert on browser telemetry that indicates script execution from unexpected origins during groupware sessions.

How to Mitigate CVE-2025-55072

Immediate Actions Required

Apply the fixed release referenced in the desknet's NEO maintenance notice as soon as it can be scheduled.
Restrict network access to the groupware platform so that only trusted users and networks can reach the authenticated interface.
Audit recently created or edited stored content for suspicious HTML or JavaScript and remove offending records.

Patch Information

NeoJapan has published a maintenance notice describing the corrective update for desknet's NEO. Administrators should consult the Desknets Maintenance Notice and the JVN advisory to identify the fixed version applicable to their deployment and follow the vendor's upgrade procedure.

Workarounds

Deploy a web application firewall rule that blocks HTML tags and JavaScript syntax in fields that should accept plain text.
Enforce a strict Content Security Policy that disallows inline script execution and restricts script sources to trusted origins.
Ensure session cookies are issued with the HttpOnly and Secure flags to reduce the impact of script-based session theft.
Require users to re-authenticate for sensitive operations to limit unauthorized actions if a session is abused.

bash

# Example CSP header to mitigate stored XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";
add_header X-Content-Type-Options "nosniff";
add_header X-Frame-Options "SAMEORIGIN";