CVE-2025-6060: DECE Software Geodi XSS Vulnerability

CVE-2025-6060 Overview

CVE-2025-6060 is a Cross-Site Scripting (XSS) vulnerability affecting DECE Software Geodi versions before GEODI Setup 9.0.146. The flaw stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79]. An authenticated attacker with low privileges can inject malicious script content that executes in the browser context of another user who interacts with the crafted content. The scope-changed impact indicates the injected script can affect components beyond the vulnerable application. The Turkish national cybersecurity center (USOM) issued advisory TR-25-0182 tracking this issue.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in victim browser sessions, enabling session data theft, UI manipulation, and pivoting to adjacent security scopes.

Affected Products

DECE Software Geodi versions prior to GEODI Setup 9.0.146

Discovery Timeline

2025-07-29 - CVE-2025-6060 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6060

Vulnerability Analysis

The vulnerability resides in Geodi's web page generation logic, where user-controllable input is rendered back to the browser without sufficient encoding or sanitization. When an attacker submits content containing HTML or JavaScript payloads, the application reflects or stores that content in a response served to other users. The browser then parses the injected markup and executes the embedded script under the origin of the Geodi application.

Exploitation requires the attacker to hold valid low-privilege credentials and depends on user interaction, such as a victim visiting a crafted URL or opening a page containing the injected payload. The confidentiality and integrity impacts are constrained to limited data exposure and manipulation, but the changed scope means the injected script can influence resources managed by a different security authority than the vulnerable component.

Root Cause

The root cause is missing or incomplete output encoding when Geodi renders user-supplied strings into HTML responses. Web applications must contextually encode data placed in HTML body, attribute, JavaScript, or URL contexts. Geodi releases prior to 9.0.146 fail to enforce this control on at least one input-handling path.

Attack Vector

The attack is delivered over the network against an authenticated session. A typical exploitation flow involves the attacker submitting a payload containing HTML <script> tags or event-handler attributes through a Geodi input field or URL parameter. When a victim user later views the affected page, the browser parses and executes the payload. Because the scope is changed, the attacker can leverage the executed script to access resources, cookies, or tokens tied to other origins or trust boundaries reachable from the Geodi interface. See the Siber Güvenlik Advisory TR-25-0182 for additional technical context.

Detection Methods for CVE-2025-6060

Indicators of Compromise

Web server or application logs containing request parameters with <script>, onerror=, onload=, javascript:, or encoded equivalents targeting Geodi endpoints.
Unexpected outbound HTTP requests originating from user browsers immediately after loading Geodi pages, indicating script-driven data exfiltration.
Session cookies for the Geodi application observed in third-party or attacker-controlled destinations.

Detection Strategies

Deploy web application firewall signatures that inspect Geodi request bodies and query strings for HTML and JavaScript metacharacters.
Enable Content Security Policy (CSP) violation reporting to surface script execution attempts from unexpected sources.
Correlate authentication logs with anomalous input submissions to identify low-privilege accounts submitting payloads consistent with XSS probing.

Monitoring Recommendations

Monitor Geodi installation versions across the estate and alert when hosts run releases earlier than 9.0.146.
Log and review all admin-panel and shared-view actions performed by low-privilege Geodi users.
Ingest browser telemetry and web proxy logs into a centralized analytics platform to hunt for script-driven data theft patterns.

How to Mitigate CVE-2025-6060

Immediate Actions Required

Upgrade all Geodi installations to GEODI Setup 9.0.146 or later without delay.
Audit Geodi user accounts and revoke unnecessary low-privilege access to reduce the pool of potential attackers.
Force password resets and session invalidation on Geodi accounts if exploitation is suspected.

Patch Information

DECE Software addresses the vulnerability in GEODI Setup 9.0.146. Administrators should download the fixed installer from the vendor and follow standard upgrade procedures. Refer to the USOM Notification TR-25-0182 for coordinated advisory details.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Place Geodi behind a web application firewall with XSS filtering rules until the patch is applied.
Restrict Geodi access to trusted internal networks and require multi-factor authentication for all accounts.

bash

# Example restrictive Content-Security-Policy header for Geodi reverse proxy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'";
add_header X-Content-Type-Options "nosniff";
add_header X-Frame-Options "DENY";