Executive Summary

CVE-2025-9717 is a stored cross-site scripting (XSS) vulnerability in the O2OA application, specifically affecting versions up to 10.0-410. It occurs in the personal profile page component at the endpoint /x_organization_assemble_control/jaxrs/unit/{flag}. The vulnerability arises because user input in fields like name, shortName, distinguishedName, pinyin, pinyinInitial, and levelName is not properly sanitized before being stored and later rendered. This allows attackers to inject malicious scripts that execute in the browsers of users who view the affected profile, leading to persistent XSS. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to persistent execution of malicious JavaScript in the browsers of users who view the compromised personal profile page. The impact includes theft of session tokens or sensitive user data, unauthorized actions performed on behalf of authenticated users, and potential compromise of user accounts or data integrity. Since the exploit is publicly available and can be launched remotely, attackers can easily exploit this flaw to affect users. [2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of malicious scripts in the affected endpoint `/x_organization_assemble_control/jaxrs/unit/{flag}`. A practical approach is to send crafted HTTP requests (e.g., PUT requests) with payloads containing typical XSS test scripts such as `<img src=1 onerror=alert(1)>` in the fields name, shortName, distinguishedName, pinyin, or levelName, and then observe if the script executes when the profile is viewed. Network monitoring tools can also be used to detect suspicious PUT requests to this endpoint. Example command using curl to test the vulnerability: `curl -X PUT -H "Content-Type: application/json" -d '{"name":"<img src=1 onerror=alert(1)>", "shortName":"test"}' https://target/o2oa/x_organization_assemble_control/jaxrs/unit/testflag`. [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include filtering and escaping user input in the affected profile fields (name, shortName, distinguishedName, pinyin, pinyinInitial, levelName) before storing them, and ensuring proper output encoding when rendering this data in the application to prevent script execution. If possible, restrict or monitor access to the vulnerable endpoint to reduce exposure. Since no official patches or countermeasures are currently available, consider disabling or replacing the affected component until a fix is released. [2, 3]

Useful 0 Not Useful 0