Reflected XSS Vulnerability in SSL VPN Endpoint — CVE-2025-0133

How it was found

Vulnerable Website URL or Application:

█████

Description of Security Issue:

The SSL VPN endpoint exposed at the above IP address is vulnerable to Reflected Cross-Site Scripting (XSS) via the user parameter.

This issue corresponds to CVE-2025-0133, which allows an unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of a victim who clicks on a maliciously crafted link.

Successful exploitation may lead to:

• Session hijacking
• Credential theft
• Browser-based exploits

This vulnerability poses a serious risk when combined with phishing or social engineering attacks.

Exploit Scenario:

An attacker crafts a malicious link to the VPN endpoint, injecting JavaScript in the user parameter. If a user with access to the VPN portal clicks the link, the injected code will be executed in their browser.

Once opened by a victim, the script will execute immediately, demonstrating the vulnerability.

Steps to Reproduce Bug:

1. Open the following URL in a browser:

███

2. Observe that the browser executes the JavaScript payload (a prompt popup appears), indicating an XSS vulnerability.

3. Confirm that the user parameter is reflected unsanitized into the response.

POC:

█████████

Impact

This reflected Cross-Site Scripting (XSS) vulnerability can lead to critical security risks, especially since it affects a Fortinet SSL VPN endpoint — a commonly targeted enterprise asset.

System Host(s)

█████

Affected Product(s) and Version(s)

CVE Numbers

CVE-2025-0133

Steps to Reproduce

1. Open the following URL in a browser:

█████

2. Observe that the browser executes the JavaScript payload (a prompt popup appears), indicating an XSS vulnerability.

3. Confirm that the user parameter is reflected unsanitized into the response.

Suggested Mitigation/Remediation Actions