Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input
Date: 2025-03
Affected: go/github.com/beego/beego, go/github.com/beego/beego/v2
Attack vector: xss
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2025-30223
CWE: CWE-79
CVSS: 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)

### Summary A Cross-Site Scripting (XSS) vulnerability exists in Beego's `RenderForm()` function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's `RenderForm()` function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). ### Details The vulnerability is located in the `renderFormField()` function in Beego's `templatefunc.go` file (around lines 316-356). This function directly injects user-provided values into HTML without proper escaping: ```go return fmt.Sprintf(`%v<input%v%v name="%v" type="%v" value="%v"%v>`, label, id, class, name, fType, value, requiredString) ``` None of the values (label, id, class, name, value) are properly HTML-escaped before being inserted into the HTML template. This allows attackers to break out of the attribute context or inject HTML tags directly. The vulnerability can be exploited in two main ways: - Attribute Injection: By injecting code into fields like DisplayName, an attacker can break out of the attribute context and execute JavaScript. - Content Injection: By injecting HTML tags into textarea content, an attacker can execute JavaScript. The `Rend


Mitigations:

Architectural layers (MAESTRO):