HTML Vulnerabilities

Question

My question is three-fold.

Background

I was asked to do some vulnerability scans on a website with some holes (I think). On a particular page, I was able to escape the text field and write on the site. If I left the site, the text I entered left.

Questions

1) How can I recommend a text field be secured (as far as validating input prior to be accepted to the html parser (which I learned runs before any of the other parsers))?

2) Is the fact that the text is non-persistant relevant? I can still put a script tag in there and it seems to run.

3) This one, I don't know if I can really expect to be answered; but, I lack imagination as to what I can do with this "hole." If I can run a script, I should be able to do something, but I don't think I know enough java script for that. What can be done (not really looking for code... necessarily...) with this?

Answer 1

1) How can I recommend a text field be secured (as far as validating input prior to be accepted to the html parser (which I learned runs before any of the other parsers))?

See https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet for information on how to prevent cross-site scripting (XSS). You will need to do data validation on the server to make sure only permitted characters are submitted, and you will need to do output encoding (e.g., most likely HTML entity encoding, but see the previous link for specifics) prior to returning the data to the browser.

2) Is the fact that the text is non-persistant relevant? I can still put a script tag in there and it seems to run.

"Reflected" XSS and "DOM-based" XSS is usually not considered to be as dangerous as "persistent" XSS, although the popularity of the site, the effectiveness of phishing/tricks by the attacker, and so on, have a big impact on how serious a reflected XSS attack truly is.

3) This one, I don't know if I can really expect to be answered; but, I lack imagination as to what I can do with this "hole." If I can run a script, I should be able to do something, but I don't think I know enough java script for that. What can be done (not really looking for code... necessarily...) with this?

Stealing keystrokes, hijacking sessions, duping users into installing malware, changing the look and feel of a site, redirecting people to sites that look the same but are actually attack sites, etc. See http://www.zdnet.com/blog/security/obama-site-hacked-redirected-to-hillary-clinton/1042 for a simple real world example.

Answer 2

I'll attempt to answer your question. So, if I understand your question correctly, you are able to inject HTML and Javascript, but it is only accessible to yourself? If this is the case, it is still potentially problematic as there might be a case where data from GET variables, child frames, parent frames, local storage, or anywhere else which might be malicious could inject itself or other javascript into the open page, thereby potentially causing more damage to you. This could possibly be with clickjacking, drive-by-downloads, etc...

As far as recommendations for rectifying this vulnerability, it is a bit difficult because there would have to necessarily be javascript validation, possibly with the onchange event, or onblur event. However, one can never really rely on Javascript for anything security related, as it is so easily disabled or altered.