CVE-2025-67633

Executive Summary

CVE-2025-67633 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Greenhouse Job Board WordPress plugin, developed by Brownbagmarketing. The vulnerability affects all versions up to and including 2.7.3. An attacker can inject malicious scripts into the DOM of a victim's browser by manipulating client-side input, leading to data theft, session hijacking, or defacement. The vulnerability is unpatched, and no public proof-of-concept (PoC) or exploit code is available at this time. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should monitor for updates from the vendor and consider temporary deactivation if the plugin is not critical. No package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – Exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – Victim must click a crafted link or visit a malicious page.
• Scope (S): Changed – Impact can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No denial-of-service impact.

Threat Level: Medium. The vulnerability requires user interaction but can be chained with social engineering for targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the Greenhouse Job Board plugin, which embeds job listings via a shortcode or widget. The plugin improperly sanitizes user-supplied input that is later reflected in the DOM without server-side validation. Specifically, the plugin uses JavaScript to dynamically update the page content based on URL parameters or other client-side data sources (e.g., document.location.hash, document.referrer, or window.name). An attacker can craft a URL with a malicious payload in a parameter that the plugin's JavaScript reads and injects into the DOM via innerHTML or similar methods.

Root Cause: The plugin fails to escape or sanitize input before inserting it into the DOM, allowing arbitrary HTML/JavaScript execution.

Attack Flow:

1. Attacker crafts a malicious URL: https://victim.com/jobs/#<script>alert('XSS')</script>
2. Victim clicks the link.
3. The plugin's JavaScript reads the hash fragment and inserts it into the page DOM.
4. The script executes in the victim's browser context.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical fix based on best practices.

Vulnerable Code (JavaScript):

// Vulnerable: Directly inserts user input into DOM
var hash = window.location.hash.substring(1);
document.getElementById('job-details').innerHTML = hash;

Patched Code (JavaScript):

// Patched: Sanitize input using textContent or DOMPurify
var hash = window.location.hash.substring(1);
var sanitized = DOMPurify.sanitize(hash);
document.getElementById('job-details').innerHTML = sanitized;
// Alternatively, use textContent to avoid HTML injection
document.getElementById('job-details').textContent = hash;

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target WordPress site with Greenhouse Job Board plugin <= 2.7.3.
• Victim must be logged in or have a session.

Exploit Steps:

1. Identify a page using the plugin (e.g., /jobs/).
2. Craft a payload: <img src=x onerror=alert(document.cookie)>
3. Encode the payload in a URL fragment: https://victim.com/jobs/#<img%20src=x%20onerror=alert(document.cookie)>
4. Send the link to the victim via phishing email or social media.
5. When the victim clicks, the script executes, stealing cookies or performing actions on their behalf.

No public exploit code is available.

Blue Team (Defender)

Detection:

• Monitor web server logs for requests containing <script, onerror, onload, or other XSS patterns in URL fragments.
• Use WAF rules to block common XSS payloads in URL fragments.
• Deploy Content Security Policy (CSP) headers to restrict script execution.

Lab Setup:

• Install WordPress with Greenhouse Job Board plugin v2.7.3.
• Use a browser with developer tools to test payloads.
• Monitor network traffic with Burp Suite or OWASP ZAP.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests with suspicious URL fragments containing <script, onerror, onload, javascript:.
  • Referer headers pointing to malicious domains.
• Host:
  • Unexpected JavaScript execution in browser console.
  • Unauthorized cookie theft or session hijacking.
• File:
  • No file-based IOCs as this is a client-side vulnerability.

Detection Engineering

YARA Rule

rule CVE_2025_67633_DOM_XSS {
    meta:
        description = "Detects DOM-based XSS payloads targeting Greenhouse Job Board plugin"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-67633"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $payload3 = /onload\s*=\s*["']?[^"']*["']?/i
        $payload4 = /javascript:\s*[^"']+/i
    condition:
        any of them
}

Sigma Rule

title: DOM-Based XSS Attempt Against Greenhouse Job Board
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential DOM-based XSS attacks targeting the Greenhouse Job Board plugin
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in URL fragments (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67633 DOM-Based XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/jobs/"; http_uri; pcre:"/(<script|onerror=|onload=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Deactivate the plugin if not essential until a patch is released.
2. Implement a Web Application Firewall (WAF) with rules to block XSS payloads in URL fragments.
3. Add Content Security Policy (CSP) headers: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' (adjust as needed).

Long-Term Fix:

• The vendor must release a patched version that sanitizes all client-side input before DOM insertion.
• Use textContent instead of innerHTML or integrate a library like DOMPurify.

Workaround:

• Modify the plugin's JavaScript file to use textContent or DOMPurify.sanitize() (requires code access).

Valters IT
Securing Digital Frontiers