CVE-2025-64710: Bitplatform Boilerplate XSS Vulnerability

CVE-2025-64710 Overview

CVE-2025-64710 is a cross-site scripting (XSS) vulnerability [CWE-79] in Bitplatform Boilerplate, a Visual Studio and .NET project template distributed by the bit foundation. The flaw resides in the WebInteropApp/WebAppInterop component and stems from unvalidated URL handling during client-side redirection. Attackers can craft malicious URLs that inject scripts into the application context. Applications generated from vulnerable versions of the boilerplate template may inherit this weakness. The maintainers released version 9.11.3 to address the issue.

Critical Impact
Attackers can inject arbitrary scripts through the WebInteropApp redirect handler, compromising the confidentiality and integrity of web applications built on Bitplatform Boilerplate.

Affected Products

Bitplatform Boilerplate versions prior to 9.11.3
Bit.Boilerplate project templates for Visual Studio and .NET
Downstream applications generated from vulnerable Bitplatform Boilerplate versions

Discovery Timeline

2025-11-13 - CVE-2025-64710 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64710

Vulnerability Analysis

The vulnerability exists in the WebInteropApp.ts script that handles cross-window communication and redirection in Bitplatform Boilerplate applications. The affected code reads a url parameter from URL query parameters and uses it for redirection without validating the target protocol or origin. An attacker can supply a javascript: URL or a URL pointing to an attacker-controlled origin. Because the redirect is initiated from within the trusted application context, injected scripts execute with the privileges of the victim's session. The result is a reflected XSS condition that requires user interaction to trigger.

Root Cause

The root cause is missing input validation on the urlToOpen value derived from urlParams.get('url'). The original client-side logic in WebInteropApp.ts passed the attacker-controlled URL directly to redirection logic without asserting protocol type or same-origin constraints. This allowed non-HTTP schemes such as javascript: to reach the browser navigation APIs, enabling script execution in the application's origin.

Attack Vector

Exploitation requires an attacker to deliver a crafted link to a victim and convince them to click it. When the victim opens the link, the vulnerable WebInteropApp handler consumes the malicious url parameter and performs the unsafe redirect. Because the vector is network-based and requires user interaction, it aligns with reflected XSS scenarios commonly abused in phishing campaigns.

typescript

        const urlToOpen = urlParams.get('url')!.toString();
        const localHttpPort = urlParams.get('localHttpPort')?.toString();

+        try {
+            const redirectUrl = new URL(urlToOpen, window.location.origin);
+            if (redirectUrl.protocol !== "http:" && redirectUrl.protocol !== "https:") {
+                throw new Error("Invalid protocol for redirection.");
+            }
+            if (redirectUrl.origin !== window.location.origin) {
+                throw new Error("Redirect to a different origin is not allowed.");
+            }
+        } catch (e) {
+            console.error("Invalid or malicious redirect URL detected:", e);
+            return;
+        }
+
        if (!localHttpPort) {
            // Blazor WebAssembly, Auto or Server:
            if (window.opener) {

Source: GitHub Commit 4700894. The patch constructs a URL object from the input and rejects anything other than http: or https: schemes or cross-origin destinations.

Detection Methods for CVE-2025-64710

Indicators of Compromise

Requests to Bitplatform Boilerplate endpoints containing a url query parameter with javascript:, data:, or vbscript: schemes
Redirect requests targeting WebInteropApp or WebAppInterop routes with cross-origin destinations
Browser console errors referencing invalid or malicious redirect URLs after patch deployment

Detection Strategies

Inspect web server and reverse proxy logs for HTTP requests to WebInteropApp handlers containing suspicious url parameter values
Deploy web application firewall (WAF) rules that flag non-HTTP schemes in query parameters passed to interop endpoints
Review dependency manifests such as .csproj and template metadata to identify projects generated from Bit.Boilerplate versions below 9.11.3

Monitoring Recommendations

Enable content security policy (CSP) violation reporting to surface unexpected inline script execution attempts
Alert on outbound redirects from Bitplatform Boilerplate applications to unfamiliar external origins
Monitor phishing telemetry for links referencing internal application hostnames with encoded url parameters

How to Mitigate CVE-2025-64710

Immediate Actions Required

Upgrade Bitplatform Boilerplate to version 9.11.3 or later and rebuild affected applications
Audit deployed applications generated from earlier boilerplate versions and apply the equivalent patch to WebInteropApp.ts
Rotate any session tokens that may have been exposed through successful XSS exploitation

Patch Information

The fix is available in Bitplatform Boilerplate 9.11.3. Full technical details are provided in the GitHub Security Advisory GHSA-rv95-xj37-7c3w and the upstream commit 4700894. The patch enforces protocol and same-origin validation on redirect URLs handled by the WebInteropApp script.

Workarounds

Apply the upstream URL validation logic directly to Client/Boilerplate.Client.Core/Scripts/WebInteropApp.ts if a full template upgrade is not immediately feasible
Deploy a strict Content-Security-Policy header that disallows inline scripts and javascript: navigation
Restrict access to WebInteropApp and WebAppInterop endpoints at the reverse proxy until patching is complete

bash

# Update the Bitplatform Boilerplate template package
dotnet new uninstall Bit.Boilerplate
dotnet new install Bit.Boilerplate::9.11.3

# Verify installed template version
dotnet new list | grep -i boilerplate