Stored XSS in Request Tracker calendar invitations
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Stored XSS in Request Tracker calendar parsing allows JavaScript execution in user context via crafted email.
CERT Polska discovered a stored cross-site scripting vulnerability in Best Practical Request Tracker's calendar invitation parsing feature. The flaw exists because the software displays invitation data without HTML sanitization, allowing an attacker to send a specially crafted email that executes JavaScript code when a logged-in user views the ticket. This is a stored XSS—the malicious payload persists in the system and executes each time an authorized user accesses the affected ticket.
The vulnerability affects Request Tracker versions 5.0.4 through 5.0.8 and 6.0.0 through 6.0.1. Defenders running these versions should update immediately. The attacker needs only to send a crafted email to a Request Tracker instance; the malicious script runs in the victim's browser session, potentially allowing account takeover, data theft, or lateral movement within the RT instance. There is no public indication of active exploitation in the wild at the time of disclosure.
Mentioned in this report
Detection guidance
Script Injection Markers in Request Tracker Ticket or Helper Requests
Detects script-injection markers in query strings sent to Request Tracker ticket, helper or REST endpoints, which can indicate XSS payloads or follow-on requests from injected JavaScript. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Script Injection Markers in Request Tracker Ticket or Helper Requests
description: Detects HTML/JavaScript injection markers in query strings sent to Request
Tracker (RT) ticket, helper or REST endpoints. The stored XSS in calendar invitation
parsing (RT 5.0.4-5.0.8, 6.0.0-6.0.1) is delivered by email and the payload itself
is not visible in web logs. This rule only catches script markers that reach the
web tier, for example requests made by injected JavaScript or probing of RT. Treat
it as a hunting aid and combine it with patch-level checks.
tags:
- attack.execution
- attack.t1059.007
- attack.initial-access
- attack.t1189
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|contains:
- /Ticket/
- /Helpers/
- /REST/
- /Articles/
selection_payload:
cs-uri-query|contains:
- <script
- '%3Cscript'
- 'javascript:'
- onerror=
- onload=
- document.cookie
condition: selection_path and selection_payload
falsepositives:
- Authorised web application security scanners testing the RT instance
- Users searching tickets for text that discusses JavaScript or HTML snippets
level: medium
id: 0bbd4933-57d2-5615-85ee-7f743fbbab22
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2025/10/CVE-2025-9158
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/10/CVE-2025-9158
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs