CVE-2025-9658: Zoneland O2oa XSS Vulnerability

CVE-2025-9658 Overview

CVE-2025-9658 is a cross-site scripting (XSS) vulnerability in O2OA versions up to 10.0-410. The flaw resides in an unknown function within /x_portal_assemble_designer/jaxrs/dict/, part of the Personal Profile Page component. Attackers can inject malicious script content through the name, alias, or description arguments. Exploitation requires network access, low privileges, and user interaction. The vendor acknowledged the issue on GitHub and indicated a fix will ship in a future release. A public exploit has been disclosed.

Critical Impact
Authenticated attackers can inject persistent JavaScript into the Personal Profile Page, enabling session theft or malicious actions in the context of other O2OA users.

Affected Products

Zoneland O2OA versions up to and including 10.0-410
Component: Personal Profile Page (/x_portal_assemble_designer/jaxrs/dict/)
Affected parameters: name, alias, description

Discovery Timeline

2025-08-29 - CVE-2025-9658 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9658

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. It affects the dictionary endpoint under /x_portal_assemble_designer/jaxrs/dict/ in the Personal Profile Page component. O2OA fails to sanitize or encode user-supplied values passed through the name, alias, and description fields. When these values render in the browser, embedded script content executes in the victim's session context.

Exploitation requires an authenticated account with low privileges and interaction from a target user viewing the affected page. Successful attacks can result in session cookie exfiltration, unauthorized API calls, or defacement of profile content within the O2OA workspace.

Root Cause

The root cause is missing output encoding and inadequate input validation on dictionary fields exposed by the profile designer. User input reaches the DOM without contextual escaping, allowing HTML and JavaScript payloads to be interpreted by the browser rather than treated as text.

Attack Vector

An authenticated attacker submits a crafted payload through the dictionary API endpoint by manipulating the name, alias, or description parameters. When another user loads the Personal Profile Page containing the poisoned dictionary entry, the injected script executes in that user's browser session. Because the payload is stored server-side, the attack persists across sessions until the entry is removed.

See the GitHub Issue #174 Discussion and the VulDB Entry #321866 for additional technical context.

Detection Methods for CVE-2025-9658

Indicators of Compromise

Dictionary entries under /x_portal_assemble_designer/jaxrs/dict/ containing HTML tags such as <script>, <img onerror=>, or <svg onload=> in name, alias, or description fields.
Outbound HTTP requests from user browsers to unfamiliar domains immediately after loading a Personal Profile Page.
Unexpected profile modifications or session anomalies affecting multiple O2OA users after viewing shared profile content.

Detection Strategies

Inspect O2OA application logs for POST or PUT requests to the dictionary endpoint containing angle brackets, JavaScript keywords, or event handlers.
Deploy a web application firewall (WAF) rule that flags XSS payload patterns targeting the /x_portal_assemble_designer/jaxrs/dict/ path.
Correlate authenticated user activity against modifications of profile dictionary records to identify suspicious authoring behavior.

Monitoring Recommendations

Enable Content Security Policy (CSP) violation reporting in browsers accessing O2OA to surface inline script execution attempts.
Monitor authentication events for compromised sessions or anomalous API calls originating from users who recently viewed affected profile pages.
Track database changes to the O2OA dictionary tables for entries containing markup characters.

How to Mitigate CVE-2025-9658

Immediate Actions Required

Restrict access to the Personal Profile Page dictionary functionality to trusted administrative users until a patched release is available.
Audit existing dictionary records for stored HTML or JavaScript payloads and remove any suspicious entries.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources for the O2OA web application.

Patch Information

The vendor confirmed in GitHub Issue #174 that the issue will be addressed in a future release. As of the last NVD update, no fixed version has been designated. Monitor the O2OA project repository for release announcements and apply the patched version once published.

Workarounds

Apply a reverse-proxy or WAF filter that strips or blocks HTML control characters in requests to /x_portal_assemble_designer/jaxrs/dict/.
Limit dictionary editing permissions through O2OA role assignments so that only vetted accounts can create or modify entries.
Educate users to avoid opening profile pages from untrusted contributors until the vendor patch is deployed.

bash

# Example nginx rule to block script tags in dictionary requests
location /x_portal_assemble_designer/jaxrs/dict/ {
    if ($request_body ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
    proxy_pass http://o2oa_backend;
}