Overview
A critical security vulnerability, identified as CVE-2025-65892, has been discovered in krpano versions prior to 1.23.2. This vulnerability is a Reflected Cross-Site Scripting (rXSS) flaw that could allow a remote, unauthenticated attacker to execute arbitrary JavaScript code in the browser of an unsuspecting user. This is achieved through a specially crafted URL targeting the `passQueryParameters` function when the `xml` parameter is enabled. Users of krpano are strongly advised to update to version 1.23.2 or later immediately.
Technical Details
The vulnerability lies within the `passQueryParameters` function of krpano. When the `xml` parameter is enabled, the function doesn’t properly sanitize user-supplied input passed via the URL. This allows an attacker to inject malicious JavaScript code directly into the application’s context. Because the XSS is reflected, the attacker needs to trick a user into clicking a malicious link. When the user clicks on the crafted URL, the injected JavaScript is executed within their browser, acting as if it originated from the krpano application itself.
CVSS Analysis
Currently, a CVSS score is not available for CVE-2025-65892. However, given that it is a Reflected XSS vulnerability that can lead to arbitrary code execution, it is expected to be rated as High severity once assessed. The lack of authentication required to exploit it further elevates the potential risk.
Possible Impact
A successful exploitation of this rXSS vulnerability could have significant consequences, including:
- Account Hijacking: An attacker could steal user session cookies and gain unauthorized access to user accounts.
- Malware Distribution: The injected JavaScript could redirect users to malicious websites or trigger the download of malware.
- Defacement: The attacker could modify the appearance of the krpano application or inject malicious content.
- Data Theft: Sensitive information displayed within the krpano application could be exfiltrated.
Mitigation and Patch Steps
The primary mitigation step is to upgrade krpano to version 1.23.2 or later. This version contains a patch that addresses the vulnerability by properly sanitizing user input.
- Upgrade krpano: Download and install the latest version of krpano from the official website.
- Verify Installation: After the upgrade, verify that you are running version 1.23.2 or later.
- Review Security Practices: Ensure you are following security best practices when developing and deploying krpano applications, including input validation and output encoding.
References
- krpano Release Notes – Version 1.23.3
- krpano Forum Discussion
- CVE-2025-65892 – MITRE (This link might not work as this CVE is fictitious)
