CVE-2026-0587: Rockoa Rockoa XSS Vulnerability

CVE-2026-0587 Overview

CVE-2026-0587 is a reflected cross-site scripting (XSS) vulnerability in Xinhu Rainrock RockOA versions up to 2.7.1. The flaw exists in the rock_page_gong.php file within the Cover Image Handler component. Attackers can manipulate the fengmian argument to inject arbitrary script content that executes in the browser of an authenticated user. The vulnerability is remotely exploitable over the network and requires user interaction. According to VulDB, the exploit has been publicly released. The vendor was contacted prior to disclosure but did not respond.

Critical Impact
Authenticated attackers can inject malicious scripts through the fengmian parameter, enabling session theft, credential harvesting, or actions performed on behalf of the victim within the RockOA application.

Affected Products

Xinhu Rainrock RockOA versions up to and including 2.7.1
Component: Cover Image Handler (rock_page_gong.php)
Vulnerable parameter: fengmian

Discovery Timeline

2026-01-05 - CVE-2026-0587 published to the National Vulnerability Database
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-0587

Vulnerability Analysis

The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). The RockOA application fails to sanitize the fengmian parameter processed by the Cover Image Handler in rock_page_gong.php. When the application reflects the parameter value into rendered HTML, attacker-controlled markup and JavaScript execute in the victim's browser session. The attack requires the victim to interact with a crafted link or page, and the attacker must hold a low-privilege account to reach the affected endpoint.

Root Cause

The root cause is missing output encoding and input validation on the fengmian request argument. The Cover Image Handler accepts user-supplied data and incorporates it into HTML output without neutralizing characters such as <, >, and quotes. This allows arbitrary HTML and script content to be rendered inline.

Attack Vector

An attacker delivers a crafted URL targeting rock_page_gong.php with a malicious payload in the fengmian parameter. When an authenticated RockOA user opens the link, the injected script executes in the application's origin. Payloads can exfiltrate session cookies, perform CSRF-style actions, or modify rendered page content. The exploit has been published, lowering the barrier for opportunistic abuse.

No verified proof-of-concept code is available from authoritative sources. Refer to VulDB Entry #339493 for technical details and the public submission record at VulDB Submission #725384.

Detection Methods for CVE-2026-0587

Indicators of Compromise

HTTP requests to rock_page_gong.php containing encoded or raw HTML tags such as <script>, onerror=, or javascript: in the fengmian parameter
Outbound requests from user browsers to attacker-controlled domains shortly after accessing RockOA pages
Unexpected session activity, including session token reuse from multiple source IPs

Detection Strategies

Inspect web server access logs for fengmian parameter values containing angle brackets, event handlers, or URL-encoded script payloads
Deploy a web application firewall (WAF) rule that flags reflected XSS patterns against /rock_page_gong.php
Correlate authenticated RockOA session activity with anomalous outbound DNS or HTTP traffic from client endpoints

Monitoring Recommendations

Enable verbose HTTP request logging on the RockOA web server and retain logs for retrospective analysis
Monitor browser security telemetry on endpoints accessing RockOA for script-based credential exfiltration attempts
Alert on repeated requests to the Cover Image Handler from a single source within short time windows

How to Mitigate CVE-2026-0587

Immediate Actions Required

Restrict network access to the RockOA application to trusted users and networks until a patch is available
Apply WAF rules that block or sanitize HTML metacharacters in the fengmian parameter
Inform RockOA users of the risk of clicking unsolicited links referencing internal RockOA URLs

Patch Information

As of the last NVD update on 2026-04-29, no vendor patch has been published. The vendor did not respond to disclosure attempts according to the VulDB advisory. Monitor the VulDB CTI entry for updates on remediation availability.

Workarounds

Place the RockOA application behind a reverse proxy that strips or encodes <, >, ", and ' characters in query parameters targeting rock_page_gong.php
Enforce a strict Content Security Policy (CSP) header that disallows inline script execution to limit XSS impact
Set the HttpOnly and SameSite=Strict flags on session cookies to reduce the risk of session theft via injected scripts

bash

# Example NGINX configuration to block suspicious fengmian payloads
location /rock_page_gong.php {
    if ($arg_fengmian ~* "(<|>|script|onerror|javascript:)") {
        return 403;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'";
    add_header X-XSS-Protection "1; mode=block";
    proxy_pass http://rockoa_backend;
}