CVE-2025-60916 Overview
CVE-2025-60916 is a reflected cross-site scripting (XSS) vulnerability in Austrian Archaeological Institute OpenAtlas before version 8.12.0. The flaw resides in the /overview/network/ endpoint and stems from improper sanitization of the charge parameter. An authenticated attacker can inject crafted JavaScript that executes in the context of a victim's browser session. Successful exploitation allows session hijacking, credential theft, or unauthorized actions performed on behalf of the targeted user. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking and unauthorized actions within OpenAtlas.
Affected Products
- Craws OpenAtlas versions prior to 8.12.0
- OpenAtlas /overview/network/ endpoint accepting the charge parameter
- Deployments operated by the Austrian Archaeological Institute and third-party users of OpenAtlas
Discovery Timeline
- 2025-11-24 - CVE-2025-60916 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-60916
Vulnerability Analysis
The vulnerability is a reflected XSS flaw in the OpenAtlas web application. The /overview/network/ endpoint accepts a charge request parameter and reflects its value back into the rendered HTML without proper output encoding or input sanitization. When a victim loads a crafted URL, the injected payload executes within the victim's browser context under the same origin as the OpenAtlas application.
Exploitation requires low privileges because the endpoint sits behind authentication, limiting the attack surface to users who can be lured into clicking a crafted link. User interaction is not required at the HTTP level, but delivery typically relies on social engineering or a chained redirect. The payload runs with access to the victim's session cookies, Document Object Model (DOM), and any client-side storage tied to the OpenAtlas origin.
Root Cause
The root cause is improper neutralization of user-supplied input in the charge query parameter. The application reflects the parameter value into the HTTP response without applying contextual output encoding appropriate for HTML, attribute, or JavaScript sinks. This matches the CWE-79 pattern for reflected XSS.
Attack Vector
The attacker crafts a URL targeting /overview/network/ with a malicious payload embedded in the charge parameter. The attacker delivers the link to an authenticated OpenAtlas user through email, chat, or an attacker-controlled website. When the victim loads the URL, the server reflects the payload and the browser executes it. Technical details are available in the Sec4You XSS Vulnerability Report.
Detection Methods for CVE-2025-60916
Indicators of Compromise
- HTTP requests to /overview/network/ containing charge parameter values with <script>, javascript:, onerror=, or onload= substrings
- URL-encoded script fragments such as %3Cscript%3E or %3Cimg in access logs for the OpenAtlas application
- Unusual outbound requests from authenticated OpenAtlas user sessions to unknown third-party domains
- Session anomalies such as unexpected privilege-sensitive actions following a visit to /overview/network/
Detection Strategies
- Deploy a web application firewall (WAF) rule set that inspects the charge query parameter for HTML and JavaScript metacharacters
- Review application access logs for GET requests to /overview/network/ with suspicious query string content
- Correlate referrer headers pointing to external domains with subsequent authenticated activity in OpenAtlas
Monitoring Recommendations
- Enable verbose logging on the OpenAtlas reverse proxy to capture full query strings for the affected endpoint
- Alert on repeated /overview/network/ requests from a single source with varying charge payloads, indicating fuzzing
- Monitor Content Security Policy (CSP) violation reports if a report-only CSP is deployed on the application
How to Mitigate CVE-2025-60916
Immediate Actions Required
- Upgrade OpenAtlas to version 8.12.0 or later on all production and staging instances
- Audit application access logs for prior exploitation attempts targeting the charge parameter
- Rotate active user sessions and invalidate session tokens after patching to limit residual risk
- Educate privileged users about the risk of clicking untrusted OpenAtlas links until upgrades are complete
Patch Information
The OpenAtlas maintainers addressed the issue in version 8.12.0. Operators should upgrade according to the project's standard deployment process. Refer to the Sec4You Vulnerabilities Overview for additional context on the finding.
Workarounds
- Deploy a WAF rule that blocks or sanitizes requests to /overview/network/ containing HTML or script metacharacters in the charge parameter
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
- Restrict access to the OpenAtlas administrative interface to a trusted network segment or VPN until the patch is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
