CVE-2025-45286: 
NixOS vulnerability analysis and mitigation

CVE-2025-45286 is a reflected Cross-Site Scripting (XSS) vulnerability in mccutchen/go-httpbin, a Go implementation of the httpbin HTTP testing service. The flaw allows attackers to execute arbitrary web scripts or HTML in a victim's browser by crafting a malicious URL that sets the response Content-Type to text/html via a GET parameter. It affects all versions of go-httpbin prior to 2.18.0. The vulnerability was originally published by the maintainer on March 20, 2025, and assigned CVE-2025-45286 with a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is improper neutralization of script-related HTML tags in web page output (CWE-80 / CWE-79), where go-httpbin allows clients to freely control the Content-Type response header via GET query parameters. When an attacker sets Content-Type=text/html, the browser interprets the response body as HTML, enabling injected script payloads to execute. Three specific endpoints are affected: /response-headers?Content-Type=text/html&xss=<payload>, /base64/<encoded_payload>?content-type=text/html, and /base64/decode/<encoded_payload>?content-type=text/html. Exploitation requires no authentication but does require user interaction — a victim must visit a crafted URL (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session against the go-httpbin instance. Potential consequences include theft of sensitive personal information, CSRF token access, session hijacking, cookie injection, credential theft, and phishing. The CVSS assessment reflects low confidentiality and low integrity impact with no availability impact; the scope is changed (affecting the user's browser context beyond the vulnerable component itself) (GitHub Advisory, Red Hat CVE).

There is no evidence of active in-the-wild exploitation or a public proof-of-concept exploit at this time. The EPSS score is approximately 0.006% (0th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Red Hat CVE).

1. Identify target: Locate a publicly accessible or internally deployed instance of go-httpbin running a version prior to 2.18.0.
2. Craft malicious URL: Construct a URL targeting one of the vulnerable endpoints with a Content-Type=text/html parameter and an XSS payload, for example:
   • /response-headers?Content-Type=text/html&xss=%3Cimg/src/onerror=alert(%27xss%27)%3E
   • /base64/PGltZy9zcmMvb25lcnJvcj1hbGVydCgneHNzJyk+?content-type=text/html
3. Deliver to victim: Send the crafted URL to a target user via phishing email, social engineering, or embedding it in a malicious web page.
4. Payload executes: When the victim clicks the link, their browser receives a response with Content-Type: text/html containing the injected payload, causing the script to execute in the browser context of the go-httpbin origin.
5. Achieve objective: The executed script can steal cookies, capture CSRF tokens, perform actions on behalf of the victim, or redirect to a phishing page (GitHub Advisory).

• Network: HTTP GET requests to go-httpbin endpoints containing Content-Type=text/html or content-type=text/html as a query parameter, particularly to /response-headers, /base64/, or /base64/decode/ paths; requests with URL-encoded HTML/script tags (e.g., %3Cimg, %3Cscript, onerror=) in query strings.
• Logs: Web server access logs showing requests to the above endpoints with suspicious query parameters containing HTML tags or JavaScript event handlers; repeated requests from the same IP with varying XSS payloads (indicating probing).
• Browser/Client Side: Unexpected JavaScript alert dialogs or redirects when accessing go-httpbin URLs; anomalous outbound network requests from the browser to attacker-controlled domains after visiting a go-httpbin URL (GitHub Advisory).

The primary remediation is to upgrade go-httpbin to version 2.18.0 or later, which restricts client control over the Content-Type response header by allowing only safe, whitelisted values (GitHub Advisory). The fix is available at the v2.18.0 release tag (mccutchen/go-httpbin@0decfd1). As interim mitigations, deploying a Web Application Firewall (WAF) with XSS detection rules can help block crafted requests, and network access to go-httpbin instances should be restricted to trusted users only. Organizations should also educate users not to click unsolicited links pointing to internal or external httpbin instances.