CVE-2025-53121 in Horizon
Summary
by MITRE • 06/26/2025
Multiple stored XSS were found on different nodes with unsanitized parameters in OpenMNS Horizon 33.0.8 and versions earlier than 33.1.6 on multiple platforms that allow an attacker to store on database and then inject HTML and/or Javascript on the page. The solution is to upgrade to Horizon 33.1.6, 33.1.7 or Meridian 2024.2.6, 2024.2.7 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Fábio Tomé for reporting this issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/30/2025
CVE-2025-53121 represents a critical stored cross-site scripting vulnerability affecting OpenMNS Horizon versions 33.0.8 and earlier, as well as Meridian versions prior to 2024.2.6. This vulnerability stems from inadequate input sanitization mechanisms within multiple application nodes, allowing attackers to inject malicious HTML and JavaScript code through unsanitized parameters. The flaw exists in the data persistence layer where user-supplied inputs are stored in the database without proper validation or encoding, creating a persistent threat that can execute malicious scripts whenever affected pages are rendered. The vulnerability falls under CWE-79 - Improper Neutralization of Input During Web Page Generation, which is a fundamental weakness in web application security that enables attackers to inject client-side scripts into web content viewed by other users. The attack vector is particularly dangerous as it leverages the application's own database as a staging ground for malicious payloads, making the exploitation more persistent and harder to detect than reflected XSS attacks.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to perform session hijacking, steal sensitive user credentials, redirect victims to malicious sites, or even escalate privileges within the application. The fact that the vulnerability affects multiple platforms within the OpenMNS Horizon ecosystem means that a single compromised parameter could potentially impact various components of the monitoring infrastructure. Attackers could exploit this weakness to gain unauthorized access to network monitoring data, manipulate alert configurations, or compromise the integrity of the entire monitoring system. The vulnerability aligns with ATT&CK technique T1566.001 - Phishing: Spearphishing Attachment, as attackers could craft malicious payloads that would be stored and executed when legitimate users interact with the application. The security implications are particularly severe given that OpenMNS Horizon is designed for internal network deployment, yet the vulnerability could potentially be exploited through lateral movement or compromised internal accounts.
Mitigation strategies should focus on immediate remediation through the recommended version upgrades to Horizon 33.1.6, 33.1.7, or Meridian 2024.2.6, 2024.2.7, which contain proper input sanitization patches. Organizations should also implement additional defensive measures including network segmentation, implementing web application firewalls to monitor for suspicious payloads, and conducting thorough input validation across all application parameters. The vulnerability highlights the importance of secure coding practices and the necessity of comprehensive security testing, particularly in applications handling sensitive monitoring data. Regular security assessments and vulnerability scanning should be conducted to identify similar weaknesses in the application's codebase. The reporting by Fábio Tomé demonstrates the value of responsible disclosure in identifying and resolving security flaws before they can be exploited in the wild. Organizations using affected versions should also consider implementing monitoring for unusual database activity and user behavior that could indicate exploitation attempts, as well as establishing incident response procedures specifically tailored to handle XSS-related security events.