Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My question is, if any characters are allowed in the alt attribute of an img tag (except for double quotes), is XSS possible? Valid image or not.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Assuming you are surrounding with double quotes, this would be fine. However, you might want to also escape <>, even though mainstream browsers won't have a problem with it, just in case someone has a broken user agent. It's valid within an attribute, not not required in a double quoted attribute: http://www.w3.org/html/wg/drafts/html/master/syntax.html#attributes-0

share|improve this answer
    
Ah, thank you. Do you think you could provide me with a link on more information on being able to exploit <> within double quotes? –  Michael Blake May 8 at 5:46
2  
I've updated my post to include a link to the HTML spec. Turns out, in double quotes, entity encoding is not required by spec, but is permitted. I'm not aware of any scenario under which you could currently exploit with <>. –  David May 8 at 5:51

You haven't mentioned how the attribute is quoted, so I've covered all possibilities of attribute quoting. This answer reflects the precondition that double quotes are already stripped as you mentioned in your question.

Yes, if the attribute itself is single quoted or unquoted:

<img src='http://www.example.com/foo.jpg' alt='user-controlled' />

and

<img src=http://www.example.com/foo.jpg alt=user-controlled />

are both vulnerable. The first is vulnerable to the following sequence

' onload='alert(&apos;xss&apos;)

so the tag becomes

<img src='http://www.example.com/foo.jpg' alt='' onload='alert(&apos;xss&apos;)' />

and the second is vulnerable to this sequence

bar onload=alert('xss')

which will be rendered as

<img src=http://www.example.com/foo.jpg alt=bar onload=alert('xss') />

Regarding the attribute being double quoted, as well as restricting or encoding double quote characters (" --> &quot;), you will need to remove or encode the ampersand character (& --> &amp;). From the HTML spec:

Attribute values are a mixture of text and character references, except with the additional restriction that the text cannot contain an ambiguous ampersand

An ambiguous ampersand is a U+0026 AMPERSAND character (&) that is followed by one or more alphanumeric ASCII characters, followed by a ";" (U+003B) character, where these characters do not match any of the names given in the named character references section.

As you cannot guarantee that user controlled data will not contain an "ambiguous ampersand", you should either remove or properly encode this characters.

Now whether an XSS attack is possible with access to only the & character to escape the attribute value, the answer is probably not.

If the value & is entered as your user data, and the tag becomes

<img alt="&" src="http://www.example.com/foo.jpg" />

and the &" will probably be interpreted as &amp;" by most browsers, so using this as an attack vector is unlikely.

However, it is best to do things properly when it comes to security, you never know if this escaping faux pas could be turned into something else evil by something such as mXSS.

share|improve this answer
1  
I'm confused as to why " would make a difference? If tag is <img alt="{userinput}"/> then user input of " onload=alert(123) onmouseover=" with server failing to escape " will result in <img alt="" onload=alert(123) onmouseover=""/> which is XSS, is it not? –  LB2 May 8 at 15:00
1  
@LB2 The OP mentioned that " was already removed from user input, so my answer reflects that. –  SilverlightFox May 8 at 15:03
    
Oh, ok, I'm not crazy then (just blind)... I clued in on "if any characters are allowed" and totally didn't see that exception. Thanks for clarifying... –  LB2 May 8 at 15:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.