Stored XSS in Aix-DB via Unsanitized Markdown Rendering

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Aix-DB through version 1.2.4. The application renders markdown with raw HTML enabled into v-html bindings without sanitization. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages. When viewed by users, the injected scripts execute in their browsers.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Aix-DB instances for markdown rendering configurations that allow raw HTML without sanitization. Check Vue.js components like MarkdownPreview/index.vue, skill-center.vue, and demand-manager.vue for v-html bindings using markdown-it or marked libraries with html:true enabled. Review server responses for unsanitized user-provided markdown content.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal user sessions, perform actions on behalf of users, or deface the application. Malicious scripts may execute when users view affected markdown content like chat responses or skill descriptions. The impact depends on user privileges and data accessed by the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements. Stored XSS may expose personal data to attackers, potentially resulting in compliance breaches and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Aix-DB to a patched version where DOMPurify sanitizes markdown output before rendering. If updating is not possible, disable HTML rendering in markdown parsers by setting html:false in markdown-it or marked configurations. Alternatively, manually integrate DOMPurify.sanitize() into all v-html bindings in affected components.

Useful 0 Not Useful 0