Overview
A critical stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2025-65621, has been discovered in Snipe-IT versions prior to 8.3.4. This flaw allows a low-privileged authenticated user to inject malicious JavaScript code into the application. This injected code can then execute within the context of an administrator’s session, potentially leading to privilege escalation and complete compromise of the Snipe-IT instance.
Technical Details
The vulnerability stems from insufficient input sanitization and output encoding within a specific feature of Snipe-IT. An attacker can inject malicious JavaScript code, which is then stored in the database. When an administrator accesses the page containing the injected code, the script executes within their browser session. This allows the attacker to perform actions on behalf of the administrator, such as creating new administrator accounts, modifying sensitive data, or executing arbitrary system commands (depending on the Snipe-IT configuration and server environment).
CVSS Analysis
While the provided information indicates a ‘N/A’ CVSS score, a stored XSS vulnerability with the potential for privilege escalation would typically receive a high to critical CVSS score. This is because it allows an attacker to gain significant control over the application. A more realistic CVSS score would likely fall in the 8.0 – 9.5 range, considering the potential impact.
Possible Impact
The impact of this vulnerability is severe. Successful exploitation can lead to:
- Complete Account Takeover: An attacker can create new administrator accounts or modify existing ones.
- Data Breach: Sensitive information stored within Snipe-IT, such as asset details, user information, and license keys, can be accessed and exfiltrated.
- System Compromise: Depending on the Snipe-IT configuration and server environment, the attacker may be able to execute arbitrary commands on the server, leading to a full system compromise.
- Service Disruption: The attacker could disrupt Snipe-IT operations by modifying or deleting critical data.
Mitigation or Patch Steps
To mitigate this vulnerability, it is strongly recommended to upgrade Snipe-IT to version 8.3.4 or later immediately. This version includes the necessary security fixes to address the stored XSS vulnerability.
If an immediate upgrade is not possible, consider implementing the following temporary workarounds (although these are not substitutes for patching):
- Input Validation: Carefully review and sanitize all user-supplied input within Snipe-IT.
- Output Encoding: Ensure that all data displayed to users is properly encoded to prevent the execution of malicious JavaScript.
- Principle of Least Privilege: Limit the privileges granted to user accounts to the minimum required for their job functions.
- Web Application Firewall (WAF): Deploy a WAF to detect and block XSS attacks.
References
Snipe-IT Official Website
CVE-2025-65621 Vulnerability Research (GitHub)
