CVE-2025-25477
Published: 28 February 2025
Description
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Security Summary
CVE-2025-25477 is a host header injection vulnerability in SysPass 3.2x. Published on 2025-02-28, it enables an attacker to load malicious JavaScript files from an arbitrary domain, which are subsequently executed in the victim's browser. The issue carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) and maps to CWE-74 (Improper Neutralization of Special Elements in Output).
An unauthenticated attacker can exploit this over the network with low attack complexity, though it requires user interaction such as a victim accessing a crafted link or page. By injecting a malicious host header, the attacker causes SysPass to fetch and execute arbitrary JavaScript in the victim's browser context, achieving high impacts on confidentiality and integrity, such as stealing sensitive data, session tokens, or performing further client-side attacks.
Mitigation details are available in the referenced advisory at https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25477.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Host header injection enables SysPass to serve malicious JS from attacker-controlled domains, facilitating drive-by compromise (T1189), JavaScript execution (T1059.007), session cookie theft (T1539), and credential theft from web browsers/password manager context (T1555.003).