Summary
baserCMS contains a stored cross-site scripting vulnerability in global shortcode expansion, allowing JavaScript supplied through an unauthenticated blog comment to execute when the comment is viewed. The issue becomes risky when shortcode processing runs after comment HTML escaping and expands attacker-controlled shortcode parameters in a page rendered on the site's origin.
baserCMS contains a stored cross-site scripting vulnerability in global shortcode expansion, allowing JavaScript supplied through an unauthenticated blog comment to execute when the comment is viewed. The issue becomes risky when shortcode processing runs after comment HTML escaping and expands attacker-controlled shortcode parameters in a page rendered on the site's origin.
Affected context
The vulnerability affects baserCMS deployments where global shortcodes are processed across complete rendered pages, including blog comments submitted by unauthenticated visitors. It is especially relevant when comment content is escaped before rendering but shortcode expansion occurs afterward, allowing certain shortcode parameters to influence generated script elements or other active content.
The vulnerability affects baserCMS deployments where global shortcodes are processed across complete rendered pages, including blog comments submitted by unauthenticated visitors. It is especially relevant when comment content is escaped before rendering but shortcode expansion occurs afterward, allowing certain shortcode parameters to influence generated script elements or other active content.
Exploit preconditions
- Attack surface: Public blog comment submission and article rendering
- Required access: Ability to submit a comment; no authenticated account is generally required
- Trigger point: A visitor or administrator opens an article containing the stored comment
- Why exploitation is possible: Global shortcode expansion processes comment content after HTML escaping, and certain shortcode parameters can control active resource URLs
- Attack surface: Public blog comment submission and article rendering
- Required access: Ability to submit a comment; no authenticated account is generally required
- Trigger point: A visitor or administrator opens an article containing the stored comment
- Why exploitation is possible: Global shortcode expansion processes comment content after HTML escaping, and certain shortcode parameters can control active resource URLs
Why this happens
The underlying flaw is an unsafe rendering pipeline in which user-controlled comment content is passed through shortcode expansion after HTML escaping has completed. A shortcode can therefore generate active HTML or script-related attributes from attacker-controlled values, bypassing the protection expected from escaping the original comment text. This behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting.
The underlying flaw is an unsafe rendering pipeline in which user-controlled comment content is passed through shortcode expansion after HTML escaping has completed. A shortcode can therefore generate active HTML or script-related attributes from attacker-controlled values, bypassing the protection expected from escaping the original comment text. This behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting.
Potential impact
- JavaScript execution in the context of the baserCMS site
- Theft or misuse of browser-accessible session data
- Actions performed through an authenticated administrator's browser
- Modification of site content or configuration where the victim has permission
- Exposure of data available to visitors or administrators
- Embedding of unintended functional components, such as contact forms
- JavaScript execution in the context of the baserCMS site
- Theft or misuse of browser-accessible session data
- Actions performed through an authenticated administrator's browser
- Modification of site content or configuration where the victim has permission
- Exposure of data available to visitors or administrators
- Embedding of unintended functional components, such as contact forms
General mitigation guidance
Mitigation should focus on preserving a strict separation between untrusted comment content and executable shortcode output.
Common defensive patterns include:
- Disabling shortcode expansion in user-generated content by default
- Allowing only an explicit, minimal shortcode allowlist in public comments
- Validating shortcode parameters against strict schemes, hosts, and expected formats
- Applying context-appropriate output encoding after all transformations are complete
- Treating generated script URLs and HTML attributes as high-risk sinks
- Requiring moderation or trusted privileges before rendering active embedded content
- Applying Content Security Policy controls that reduce script execution impact
- Running administrative sessions with least privilege and limiting sensitive browser actions
Mitigation should focus on preserving a strict separation between untrusted comment content and executable shortcode output.
Common defensive patterns include:
- Disabling shortcode expansion in user-generated content by default
- Allowing only an explicit, minimal shortcode allowlist in public comments
- Validating shortcode parameters against strict schemes, hosts, and expected formats
- Applying context-appropriate output encoding after all transformations are complete
- Treating generated script URLs and HTML attributes as high-risk sinks
- Requiring moderation or trusted privileges before rendering active embedded content
- Applying Content Security Policy controls that reduce script execution impact
- Running administrative sessions with least privilege and limiting sensitive browser actions
How teams detect issues like this
Detection can include:
- Static analysis for shortcode expansion applied to comment, message, or other user-controlled fields
- Code review checks for rendering pipelines where escaping occurs before later template or shortcode transformations
- Searches for user-controlled values reaching script URLs, HTML attributes, or raw HTML generation
- Dynamic testing of public comment fields with inert markers and verification of generated output
- Policy enforcement that blocks unapproved shortcodes and external resource origins in untrusted content
- Automated security review tools configured to identify stored XSS sinks and unsafe output contexts
Detection can include:
- Static analysis for shortcode expansion applied to comment, message, or other user-controlled fields
- Code review checks for rendering pipelines where escaping occurs before later template or shortcode transformations
- Searches for user-controlled values reaching script URLs, HTML attributes, or raw HTML generation
- Dynamic testing of public comment fields with inert markers and verification of generated output
- Policy enforcement that blocks unapproved shortcodes and external resource origins in untrusted content
- Automated security review tools configured to identify stored XSS sinks and unsafe output contexts
