Stored XSS in Axigen Mail Server timeFormat Preference

Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2025-68643 is a stored Cross-Site Scripting (XSS) vulnerability in Axigen WebMail versions before 10.5.57. It occurs because the timeFormat account preference parameter is not properly sanitized when loaded from storage.'}, {'type': 'paragraph', 'content': "An attacker can exploit this vulnerability through a multi-stage attack. First, the attacker injects malicious JavaScript into the victim's timeFormat preference by exploiting another vulnerability or using compromised credentials. Then, when the victim logs into the WebMail interface, the malicious script is executed because the unsanitized timeFormat value is inserted into the webpage's DOM."}] [1]

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': "This vulnerability can have serious impacts including the execution of arbitrary JavaScript in the victim's browser. The attacker can redirect resource loading to attacker-controlled servers, display fake login forms, steal user credentials, hijack sessions, and exfiltrate sensitive data."}] [1]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking if the Axigen WebMail server is running a vulnerable version (10.3.x, 10.4.x, 10.5.x up to 10.5.56, or 10.6.x up to 10.6.25) and verifying if the timeFormat account preference parameter has been tampered with to include malicious JavaScript payloads.

Since exploitation requires modification of the timeFormat preference, inspecting user account preferences for suspicious or unexpected JavaScript code in the timeFormat parameter can help detect compromise.

No specific commands are provided in the available resources for detection.

Useful 0 Not Useful 0

Mitigation Strategies

The recommended immediate mitigation is to update Axigen WebMail to fixed versions 10.5.57 or later, or 10.6.26 or later.

Additionally, reviewing and securing user credentials to prevent unauthorized modification of the timeFormat preference is important.

Monitoring and restricting access to the WebMail interface to trusted users can also reduce risk.

Useful 0 Not Useful 0