# CVE-2025-52204 – Reflected XSS / HTML Injection in Znuny `customer.pl`

## Summary

A Reflected Cross-Site Scripting (XSS) and HTML Injection vulnerability exists in Znuny, allowing attackers to inject arbitrary JavaScript or HTML via the parameter defined by the system configuration `CustomerPanelSessionName` in the `customer.pl` endpoint.

## Classification

- **CVE:** CVE-2025-52204
- **CWE:** CWE-79 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- **CVSS v3.1 (researcher assessment):** 6.1 Medium
- **CVSS Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
- **Public CVE record**: [CVE-2025-52204](https://www.cve.org/CVERecord?id=CVE-2025-52204)

## Impact

Successful exploitation may allow an unauthenticated remote attacker to:

- inject arbitrary HTML or JavaScript into the response
- manipulate the customer-facing login interface
- display deceptive or phishing-style content
- redirect users to attacker-controlled resources
- execute script in the victim's browser within the context of the affected application

## Attack Requirements

- No authentication required
- Remote exploitation via crafted GET request
- Access to the public customer-facing interface

## Affected / Observed Versions

### Confirmed in controlled testing

- Znuny 6.5.9
- Znuny 7.1.3

### Observed during real-world research

The issue was also observed during research on publicly exposed real-world instances running:

- Znuny 7.0.11
- Znuny 7.2.x

To avoid unnecessarily exposing third-party systems, specific targets, URLs, and validation screenshots from those instances are intentionally omitted from this public repository.

## Observed Affected Paths

During testing and research, the following request patterns were observed:

- `6.5.9 - 6.5.18`: `/otrs/customer.pl?OTRSCustomerInterface=$PAYLOAD`
- `7.0.11 - 7.2.3`: `/znuny/customer.pl?OTRSCustomerInterface=$PAYLOAD`

These are observed request patterns and may vary depending on product branch and installation layout.

The affected input is the one defined by the `CustomerPanelSessionName` system configuration. In observed deployments, this may appear as `OTRSCustomerInterface`, depending on the system configuration.

## Fixed Versions

The vendor addressed this issue in:

- [Znuny LTS 6.5.19](https://www.znuny.org/en/releases/znuny-lts-6-5-19)
- [Znuny 7.3.1](https://www.znuny.org/en/releases/znuny-7-3-1)

## Disclosure Timeline

- **July 2025** – Vulnerability discovered
- **September 22, 2025** – Vendor confirmed the issue
- **March 25, 2026** – Vendor fix released

## Proof Of Concept

### Reflected payload in controlled testing
#### Znuny 6.5.9
![PoC 1](screenshots/1.png)
![PoC 2](screenshots/2.png)
![PoC 3](screenshots/3.png)
![PoC 4](screenshots/4.png)

#### Znuny 7.1.3
![PoC 5](screenshots/5.png)
![PoC 6](screenshots/6.png)
![PoC 7](screenshots/7.png)

## Mitigation / Workarounds

Administrators should upgrade to the vendor-fixed versions:

- Znuny LTS 6.5.19
- Znuny 7.3.1

Additional good practices include:

- reviewing public exposure of the customer-facing interface
- restricting unnecessary public access where operationally possible
- monitoring requests targeting `customer.pl`
- reviewing whether local configuration hardening reduces exposure, understanding that configuration changes alone may not constitute a full product fix

## References

- [CVE-2025-52204 Record](https://www.cve.org/CVERecord?id=CVE-2025-52204)
- [Znuny 7.3.1 Release Notes](https://www.znuny.org/en/releases/znuny-7-3-1)
- [Znuny LTS 6.5.19 Release Notes](https://www.znuny.org/en/releases/znuny-lts-6-5-19)
  
## Disclosure Note

This repository documents a coordinated vulnerability disclosure process.  
It intentionally does not include:

- a live public target list
- mass-scanning data
- a weaponized payload set
- active exploitation guidance

The goal is to preserve technical accuracy while minimizing unnecessary risk to third parties.
