What’s old is new again: AI is bringing XSS vulnerabilities back to the spotlight

The US Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued a Secure by Design alert in September urging tech manufacturers to remove cross-site scripting vulnerabilities (XSS), which have long plagued security professionals, from their products.

The alert warns CEOs and other leaders at technology manufacturers “to direct their technical teams to review past instances of these defects and create a strategic plan to prevent them in the future.” Experts say that AI models are poised to compound the problem as they take in data containing XSS.

The two agencies issued more details outlining what technical leaders should do to help eliminate XSS defects from their products, including conducting code reviews, examining threat models, and using “modern web frameworks that offer easy-to-use functions for output encoding to ensure proper escaping or quoting.”

This alert is notable given that XSS vulnerabilities have been a widespread problem for cybersecurity professionals since the earliest days of the modern internet era. They originated in the 1990s and have appeared on the OWASP Top Ten Web Application Security Risks since 2003 (although in OWASP’s latest  list, they appear under the broader super set of “injection” vulnerabilities.) They have also been omnipresent on MITRE’s list of the top 25 most dangerous software weaknesses for years.

As was true of a March 2024 CISA and FBI Secure by Design alert on eliminating SQL injection vulnerabilities, another software flaw that dates back 30 years, a logical question arises: why are US federal authorities suddenly seeking to address what, in internet terms, is an ancient software vulnerability that never seems to go away?

An informal survey of over a dozen software security experts yields various answers to this question. However, the experts agree that unless developers fix the XSS flaws in their code soon, the top generative artificial intelligence players, currently incorporating software replete with XSS vulnerabilities into their models, could perpetuate the problem.

What are cross-site scripting vulnerabilities?

In their alert, CISA and the FBI define XSS vulnerabilities as those flaws that “arise when manufacturers fail to properly validate, sanitize, or escape inputs. These failures allow threat actors to inject malicious scripts into web applications, exploiting them to manipulate, steal, or misuse data across different contexts.”

An XSS vulnerability is “any opportunity that you have to not sanitize data, and then it gets used in some other capacity,” Tim Mackey, head of software supply chain risk strategy at Black Duck Software, tells CSO. “This is essentially, ‘Can I put HTML script tags in things? Can I go and render human-provided data in a context in which it wasn’t supposed to be used?'”

Fundamentally, the problem with XSS is the constant need to sanitize data input by users so that it does not get interpreted as HTML code that can transfer to other sites. “In cross-site scripting, when you display something, you have to make sure that if it’s coming from a user, that you’re escaping it, so that it doesn’t get interpreted as HTML code and executed in the context of that website,” Yves Younan, who leads the vulnerability discovery & research team at Cisco Talos, tells CSO.

Why are the US authorities flagging XSS?

It is unclear why this perennial problem has become a focus of attention. Some experts think CISA and the FBI are pushing generally outmoded federal government agencies and departments to update their technologies to modern software development frameworks that typically correct for XSS flaws.

“The problem is that many government agencies use older frameworks that still have cross-site scripting,” Andrew van der Stock, Executive Director OWASP and the Project Co-Lead of OWASP Top Ten, tells CSO. “So, the reason I think CISA and FBI are asking their agencies and others to look at this is because of these agencies that are using 10, 15, 20-year-old frameworks that don’t have the protections of the modern frameworks.”

Other experts say that the alert is aimed at C-level executives, who have the most power to order their organizations to clean up any XSS vulnerabilities. “One of the things that CISA is doing is recognizing that you need executive buy-in to get anything done,” Chris Wysopal, co-founder and CTO of Veracode, tells CSO.

“Unless you have executive attention, it’s not going to happen because developers aren’t in charge of their tasks,” Wysopal adds. “They’re not in charge of how much time they must dedicate to security. You need to have the people allocating the work to be done to prioritize security at the right level. Whoever is in charge of product, whoever is in charge of building these things to meet a certain functionality, is ultimately in charge of that.”

Still, other experts feel that CISA is addressing this old vulnerability to just generally promote better software security development and the agency’s Secure by Design initiative. Dick O’Brien, principal intelligence analyst on Symantec’s Threat Hunter Team at Broadcom, tells CSO the alert “does a good job at raising awareness of the issue and also providing guidance on how to avoid introducing these vulnerabilities. CISA is taken seriously by public and private organizations, and whatever they say, people tend to sit up and notice.”

Why is XSS still a problem after 30 years?

Regardless of why the feds are motivated to warn on the topic, XSS is still a significant cybersecurity problem after nearly three decades, with no clear-cut solutions. Many experts chalk up the longevity of this vulnerability to simple human error or software developers who don’t keep the threat of XSS at the forefront of their minds when writing code.

“The thing that’s unfortunate when it comes to security is humans are always the weak link. Whether that’s through phishing attacks, developers writing bad code, malicious actors, or insider threats, humans are always the weak link,” Shane Fry, CTO at RunSafe Security, tells CSO.

“Developers are not looking to solve security even though they should be, right? But their first and foremost responsibility is getting something done,” Fry adds. “So, you see often Stack Overflow answers that are a decade old where there’s a comment attached to the top thing saying, ‘this is wrong, don’t do this. This is going to result in cross-site request forgery or cross-site scripting vulnerabilities.’ But as a developer, ‘you go, oh, this is the solution to my problem.'”

Other experts say writing code is fundamentally so complicated that software developers don’t go the extra step to check for common security problems.

“Writing good software is hard,” James Slaughter, senior threat intelligence engineer with Fortinet’s FortiGuard Labs, tells CSO. “Writing good software that’s secure is even more difficult. It requires a conscious decision at design time to ensure best practices are followed all the way through the development cycle. This can be extremely difficult when teams are small, time is short, and margins are thin.”

Still, other experts think that as modern development frameworks supplant the older, less secure ones, fewer XSS vulnerabilities will appear in code products. “We do have very, very good defenses for SQL injection and cross-site scripting now that break that pattern; they use a different way of presenting the data to either the database engine or the user on the browser,” OWASP’s van der Stock says.

“So, we’ve solved SQL injection, we’ve solved cross-site scripting if you use modern frameworks,” he adds. “A lot of the modern frameworks for doing visual presentations make it quite hard to do cross-site scripting. In 2021, we didn’t have sufficient evidence for it to be its own thing, so it became squished into what it is, an injection pattern.”

How AI could exacerbate XSS

LLM models that underlie the rapidly emerging generative AI technologies are wholly dependent on existing internet content, including software from code repositories, to fuel their functions. To that end, AI organizations are ingesting vast amounts of code that contain XSS vulnerabilities and may inadvertently be pushing these flaws into the foreseeable future.

“This is just going to keep going as a cycle because unless we have a way to eliminate it, the AI-generated code will have cross-site scripting in it, and the next time something comes to learn, it’s going to learn from the code that has been generated by AI that still has cross-site scripting in it,” Wysopal says. “So, it’s getting baked into how we write code.”

If an AI was trained on code susceptible to cross-site scripting and the developer isn’t checking the work, “the AI that is nominally supposed to be making things better may have just made it worse,” Mackey says. “So, without having some concept of validating the results from the AI, this may be the thing that [causes us to be still] talking about cross-site scripting ten years from now.”

What CISOs should do about XSS

The CISA and FBI alert essentially advocates that organizations reduce XSS vulnerabilities to manageable and ideally negligible levels. Software security experts say that CISOs have a critical role in this process.

“I almost view [the alert] as a call to action to CISOs and CSOs and VPs of development to raise the game of cybersecurity within their development teams,” Mackey says.

“CISO should think about customer outcomes,” Wysopal says. “Think about how the customer will purchase and use your application and think about the customer having a secure experience and how that adds value to the brand and the application. We want the customer to come back. We want them to have a good experience.”

OWASP’s van der Stock thinks CISOs should embrace the idea of “security champions,” volunteers from the developer community focused on helping staff with secure software development.

“Let the developers know if you’ve got questions around security, then go to the security champions. Then, the security champions can go to the CISO team.” van der Stock says. “They know what cross-site scripting and SQL injection are. They should be involved in the peer reviews of code retrospectives and things like that so that we can start to say, ‘well, the security champions are helping people code more securely and creating a culture that is secure by design.’”