CVE-2025-9096: 
JavaScript vulnerability analysis and mitigation

CVE-2025-9096 is a reflected Cross-Site Scripting (XSS) vulnerability in ExpressGateway's express-gateway, affecting all versions up to and including 1.16.10. The flaw resides in lib/rest/routes/apps.js (and the related /users/:id route), where unsanitized user-supplied path parameters are directly embedded into HTML error responses. It was publicly disclosed on August 3, 2025 (researcher report) and published to the NVD and GitHub Advisory Database on August 18, 2025. The vulnerability carries a CVSS v3.1 base score of 3.5 (Low) and a CVSS v4.0 base score of 5.1 (Moderate) (Github Advisory, VulDB).

The root cause is improper neutralization of input during web page generation (CWE-79). In lib/rest/routes/apps.js at line 23, the router.get('/:id', ...) handler calls res.status(404).send(\Application not found: ${req.params.id}`)when no application is found, directly interpolating the attacker-controlledreq.params.idpath parameter into an HTML response served withContent-Type: text/html; charset=utf-8`. Because no HTML encoding or output sanitization is applied, an attacker can inject arbitrary HTML/JavaScript into the response. Exploitation requires the attacker to have low-level authenticated access and requires a victim (e.g., an administrator) to visit the crafted URL, making this a reflected XSS attack (Github Advisory, PoC Report).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser context of a victim who visits a crafted URL, typically targeting administrators or privileged users. Potential consequences include session cookie theft, session hijacking, unauthorized actions performed on behalf of the victim, data exfiltration of sensitive configuration or user data, and phishing/UI redress attacks. Availability is not impacted, and there is no direct server-side code execution; the impact is limited to the integrity of the victim's browser session (Github Advisory, PoC Report).

A public proof-of-concept (PoC) has been disclosed via a GitHub issue, demonstrating exploitation using a crafted curl request with a URL-encoded XSS payload targeting the /apps/:id endpoint. The CVSS v4.0 exploit maturity is rated as "Proof of Concept." The EPSS score is approximately 0.018% (5th percentile), indicating a low near-term exploitation probability. There is no evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The vendor did not respond to the researcher's disclosure (Github Advisory, VulDB).

1. Reconnaissance: Identify internet-facing Express Gateway instances with the administrative REST API enabled (default port 9877), running version 1.16.10 or earlier.
2. Craft malicious URL: Construct a URL targeting the vulnerable /apps/:id or /users/:id endpoint with a URL-encoded XSS payload in the :id parameter, e.g.:

   http://<target>:9877/apps/%3Cimg%20src=x%20onerror=alert('XSS-PoC-Success')%3E

3. Trigger 404 response: The server fails to find an application matching the injected ID and responds with Content-Type: text/html, reflecting the unsanitized payload: Application not found: <img src=x onerror=alert('XSS-PoC-Success')>.
4. Deliver to victim: Send the crafted URL to a privileged user (e.g., an administrator) via phishing email, chat, or other social engineering means.
5. Execute payload: When the victim opens the URL in their browser, the injected JavaScript executes in their browser context, enabling cookie theft, session hijacking, or other malicious actions (PoC Report).

• Network: HTTP GET requests to /apps/<payload> or /users/<payload> on the Express Gateway admin port (default 9877) containing URL-encoded HTML/JavaScript characters such as %3C, %3E, %22, onerror=, <script>, or alert(.
• Logs: Express Gateway access logs showing 404 responses to requests with suspicious path parameters containing HTML tags or JavaScript event handlers (e.g., onerror, onload, <script>).
• Network: Outbound connections from victim browsers to attacker-controlled infrastructure following access to a crafted URL, potentially carrying stolen session tokens as query parameters or in POST bodies.

As of the advisory publication date, no vendor patch is available for express-gateway, and the vendor did not respond to the disclosure. Organizations should apply the following mitigations: (1) Implement output encoding for all user-supplied path parameters before including them in HTML responses (e.g., HTML-escape req.params.id); (2) Change error responses to use Content-Type: application/json or text/plain instead of text/html to prevent browser script execution; (3) Restrict access to the Express Gateway administrative REST API to trusted networks or authenticated internal users only; (4) Deploy a Web Application Firewall (WAF) with XSS detection rules in front of the admin API. Upgrading to a version beyond 1.16.10 is recommended once a patched release becomes available (Github Advisory, PoC Report).

The vulnerability was reported by researcher HaoTao-824 via a public GitHub issue on August 3, 2025, with a working PoC included. The ExpressGateway vendor did not respond to the disclosure. The GitHub Advisory Database reviewed and published the advisory on August 19, 2025, assigning a Moderate severity rating. No significant broader media coverage or notable community commentary beyond the initial disclosure has been identified (Github Advisory, PoC Report).