XSS vulnerability reported by checkmarx

The following is an AI generated report about a Client_DOM_Stored_XSS vulnerability in the scripts/post.js:editPostSlug() method, this is impacting my WordPress instance since our IT team has a strict CVE resolution policy:

The method function embeds untrusted data in generated output with html, at line 1037 of \wordpress\wp-content\plugins\classic-editor\scripts\post.js. This untrusted data is embedded into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the generated web-page.

AI Reasoning

The AJAX callback receives the server response in the data parameter and directly injects it into the page with box.html(data). No sanitization, encoding, or validation of data is performed before this DOM‑inserting operation, allowing attacker‑controlled content to be rendered as HTML. This constitutes a stored DOM‑based XSS vulnerability.

AI Evidence

[“Line 1035: function(data) { \u2013 defines the callback parameter receiving server data.”, “Line 1037: box.html(data); \u2013 inserts the received data into the DOM as HTML.”, “No calls to functions or methods that perform sanitization, validation, or encoding on data before the html call.”]

AI Remediation

Sanitize or encode the server‑generated content before inserting it into the DOM. Options include:
1. Return plain text or JSON from the AJAX handler and use text() or a templating engine that escapes HTML.
2. Apply a client‑side sanitization library (e.g., DOMPurify) to data before calling html().
3. Ensure the server side validates and escapes any user‑controlled fields used to build the response.

Personally I think this is a bit blown out of proportion since the post request in question is affected and returned by wp-admin/ajax-admin.php anyway… so this feels a bit unnecessary, however it couldn’t hurt to leverage something like DOMPurify to do some basic sanitization on the response data.

https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Safely_inserting_external_content_into_a_page#html_sanitization

• This topic was modified 4 weeks, 1 day ago by branacleboy.