CVE-2025-30223: Github.com/beego/beego/v2 Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2j42-h78h-q4fg",
  "modified" : "2025-08-04T15:12:27Z",
  "published" : "2025-03-31T16:55:22Z",
  "aliases" : [ "CVE-2025-30223" ],
  "summary" : "Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input",
  "details" : "### Summary\n\nA Cross-Site Scripting (XSS) vulnerability exists in Beego's `RenderForm()` function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's `RenderForm()` function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do).\n\n### Details\n\nThe vulnerability is located in the `renderFormField()` function in Beego's `templatefunc.go` file (around lines 316-356). This function directly injects user-provided values into HTML without proper escaping:\n\n```go\nreturn fmt.Sprintf(`%v<input%v%v name=\"%v\" type=\"%v\" value=\"%v\"%v>`, \n    label, id, class, name, fType, value, requiredString)\n```\n\nNone of the values (label, id, class, name, value) are properly HTML-escaped before being inserted into the HTML template. This allows attackers to break out of the attribute context or inject HTML tags directly.\nThe vulnerability can be exploited in two main ways:\n\n- Attribute Injection: By injecting code into fields like DisplayName, an attacker can break out of the attribute context and execute JavaScript.\n- Content Injection: By injecting HTML tags into textarea content, an attacker can execute JavaScript.\n\nThe `RenderForm()` function returns `template.HTML`, which bypasses Go's automatic HTML escaping, making this vulnerability particularly dangerous.\n\n### PoC\n\nRetrieve the following (secret) gist: https://gist.github.com/thevilledev/8fd0cab3f098320aa9daab04be59fd2b\n\nTo run it:\n\n```go\ngo mod init beego-xss-poc\ngo mod tidy\ngo run poc.go\n```\n\nOpen your browser and navigate to http://localhost:8080/\n\nThe application demonstrates the vulnerability through several examples:\n- `/profile` - Shows a profile with malicious data in the Display Name and Bio fields\n- `/admin` - Shows multiple user profiles, including one with malicious data\n- `/submit` - Allows you to create your own profile with malicious data\n\nIn addition, you may use this Go test in `templatefunc_test.go`. The test passes, validating the vulnerability.\n\n```go\nfunc TestRenderFormXSSVulnerability(t *testing.T) {\n\ttype UserProfile struct {\n\t\tDisplayName string `form:\"displayName,text,Name:\"`\n\t\tBio         string `form:\",textarea\"`\n\t}\n\n\t// Test case 1: Attribute injection in input field\n\tmaliciousUser := UserProfile{\n\t\tDisplayName: `\" onmouseover=\"alert('XSS')\" data-malicious=\"`,\n\t\tBio:         \"Normal bio text\",\n\t}\n\n\toutput := RenderForm(&maliciousUser)\n\n\t// The vulnerable output would contain the unescaped JavaScript\n\tif !strings.Contains(string(output), `onmouseover=\"alert('XSS')\"`) {\n\t\tt.Errorf(\"Expected XSS vulnerability in attribute, but got safe output: %v\", output)\n\t}\n\n\t// Test case 2: Script injection in textarea\n\tmaliciousUser2 := UserProfile{\n\t\tDisplayName: \"Normal Name\",\n\t\tBio:         `</textarea><script>alert('XSS')</script><textarea>`,\n\t}\n\n\toutput = RenderForm(&maliciousUser2)\n\n\t// The vulnerable output would contain the unescaped script tag\n\tif !strings.Contains(string(output), `</textarea><script>alert('XSS')`) {\n\t\tt.Errorf(\"Expected XSS vulnerability in textarea content, but got safe output: %v\", output)\n\t}\n}\n```\n\n### Impact\n\nThis is a high-severity vulnerability with the following impacts:\n\n- Cross-Site Scripting (XSS): Allows execution of arbitrary JavaScript in the context of the victim's browser.\n- Session Hijacking: Attackers can steal session cookies and impersonate victims.\n- Credential Theft: Attackers can create fake login forms to steal credentials.\n- Account Takeover: Attackers can perform actions on behalf of the victim.\n- Data Exfiltration: Sensitive data visible in the browser can be stolen.\n\nThis is particularly concerning in admin panels or user management interfaces where one user's data is displayed to another user (typically an administrator).\n\n### Mitigation\n\nThe vulnerability can be fixed by properly escaping all user-provided values before inserting them into HTML, for example:\n\n```go\n// Convert value to string and escape it\nvalueStr := \"\"\nif value != nil {\n    valueStr = template.HTMLEscapeString(fmt.Sprintf(\"%v\", value))\n}\n\n// Escape the name and label\nescapedName := template.HTMLEscapeString(name)\nescapedLabel := template.HTMLEscapeString(label)\nescapedType := template.HTMLEscapeString(fType)\n\nreturn fmt.Sprintf(`%v<input%v%v name=\"%v\" type=\"%v\" value=\"%v\"%v>`, \n    escapedLabel, id, class, escapedName, escapedType, valueStr, requiredString)\n```",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/beego/beego/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.3.6"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/beego/beego"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "1.12.14"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/beego/beego/security/advisories/GHSA-2j42-h78h-q4fg"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-30223"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/beego/beego/commit/939bb18c66406466715ddadd25dd9ffa6f169e25"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/beego/beego"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2025-3585"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-03-31T16:55:22Z",
    "nvd_published_at" : "2025-03-31T17:15:42Z"
  }
}