CVE-2025-66492: Masa CMS XSS Vulnerability

CVE-2025-66492 Overview

CVE-2025-66492 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in Masa CMS, an open source Enterprise Content Management platform. The flaw exists because an unsanitized value of the ajax URL query parameter is directly written into the <head> section of the rendered HTML page. Attackers can craft URLs that inject arbitrary JavaScript, executing scripts in the context of a victim's authenticated session. Successful exploitation can lead to session hijacking, data theft, defacement, and malware distribution. The issue is fixed in versions 7.5.2, 7.4.9, 7.3.14, and 7.2.9.

Critical Impact
Attacker-controlled JavaScript executes in the victim's browser session, enabling session hijacking, credential theft, and content defacement on affected Masa CMS deployments.

Affected Products

Masa CMS versions 7.2.8 and below
Masa CMS versions 7.3.1 through 7.3.13
Masa CMS versions 7.4.0-alpha.1 through 7.4.8, and 7.5.0 through 7.5.1

Discovery Timeline

2025-12-12 - CVE-2025-66492 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66492

Vulnerability Analysis

Masa CMS reflects the ajax query string parameter directly into the HTML <head> block without applying output encoding or input sanitization. Because the reflection point is inside <head>, an attacker can close surrounding tags and inject <script> blocks or event handlers. The vulnerability requires user interaction, typically clicking a crafted link, and executes with the privileges of the browsing user. In authenticated administrator contexts, this creates a path to account takeover.

Root Cause

The root cause is trust in the request-scope variable rc.ajax, which is derived from the URL query string and rendered without escaping. In the vulnerable template admin/common/layouts/compact.cfm, the value is emitted with #rc.ajax#, causing raw output into HTML context. The upstream fix moves the value into a server-controlled variable request.ajax populated by trusted logic, breaking the direct link between attacker-controlled input and DOM output.

Attack Vector

Exploitation is network-based and requires a victim to load a crafted URL such as https://target/admin/?ajax=</script><script>...</script>. The injected payload runs on page load and can exfiltrate cookies, invoke administrative endpoints via the victim's session, or rewrite page content. Because the reflection scope changes from the current page to the browser, the vulnerability results in a scope change consistent with typical reflected XSS behavior.

text

// Patch: admin/common/layouts/compact.cfm
// Vulnerable output replaced with server-populated value
            indexfileinapi: #rc.$.globalConfig('indexfileinapi')#
        });
    </script>
-        #rc.ajax#
+        #request.ajax#

    <cfif cgi.http_user_agent contains 'msie'>
        <!--[if lte IE 8]>
// Source: https://github.com/MasaCMS/MasaCMS/commit/376c27196b1e2489888b7a000cdf5c45bb85959e

Detection Methods for CVE-2025-66492

Indicators of Compromise

Web server access logs containing requests to Masa CMS admin paths with an ajax query parameter that includes <, >, script, onerror, onload, or URL-encoded equivalents (%3C, %3E).
Referrer headers linking users into the admin interface from untrusted external domains carrying an ajax parameter.
Unexpected outbound requests from browser sessions to attacker-controlled hosts shortly after loading an admin page.

Detection Strategies

Inspect HTTP request logs for the ajax parameter and flag values that do not match expected safe patterns such as short alphanumeric tokens.
Deploy a runtime WAF signature to detect XSS payload characters within the ajax parameter across all URI paths served by Masa CMS.
Correlate administrator session activity with reflected parameter anomalies to surface potential session hijacking following a malicious click.

Monitoring Recommendations

Enable verbose access logging on Masa CMS front-end and admin endpoints, retaining full query strings for retrospective analysis.
Alert on Content Security Policy (CSP) violation reports referencing inline script execution in the admin <head> context.
Monitor for administrator account changes, new user creation, or configuration edits initiated from unusual referrers.

How to Mitigate CVE-2025-66492

Immediate Actions Required

Upgrade Masa CMS to 7.5.2, 7.4.9, 7.3.14, or 7.2.9 depending on the currently deployed branch.
Restrict administrative interface access to trusted networks or VPN users until patching is complete.
Invalidate active administrator sessions after upgrade to eliminate any tokens potentially harvested via exploitation.

Patch Information

The fix is available in Masa CMS 7.5.2, 7.4.9, 7.3.14, and 7.2.9. The upstream commit 376c2719 refactors the vulnerable reflection by replacing rc.ajax with the server-controlled request.ajax value across admin/Application.cfc and admin/common/layouts/compact.cfm. Details are available in the MasaCMS Security Advisory GHSA-249c-vqwv-43vc and the upstream fix commit.

Workarounds

Deploy a Web Application Firewall (WAF) rule, such as a ModSecurity signature, to block requests where the ajax query parameter contains XSS payload characters like <, >, ", ', or script.
Implement server-side middleware that strips or HTML-escapes dangerous characters from the ajax parameter before it reaches the rendering layer.
Add a strict Content Security Policy that disallows inline scripts to reduce the exploitability of reflected XSS while patches are staged.

bash

# Example ModSecurity rule to block XSS characters in the ajax parameter
SecRule ARGS:ajax "@rx (?i)(<|>|script|onerror|onload|javascript:|%3C|%3E)" \
    "id:1006649,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2025-66492: XSS payload blocked in ajax parameter',\
    logdata:'Matched value: %{MATCHED_VAR}'"