Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What I understand about reflected XSS is

... When a web application is vulnerable to this type of attack, it will pass unvalidated input sent through requests back to the client... [1]

Assuming that my webapp has a CSRF validation on server that checks for a valid CSRF token for all requests. It will give proper error if it receives any request not containing CSRF token (this error is a simple string, it has no attack vectors). For the sake of completeness, let's also say that I have proper security measures for preventing CSRF token from being stolen or guessed.

So is it safe to assume that CSRF tokens also prevent reflected XSS attack because both of these are true:

  1. The server doesn't reflect anything if CSRF token is not present.
  2. The attacker cannot have or guess CSRF token.
share|improve this question
    
Using CSRF tokens to prevent XSS attacks seems to be fixing the problem by accident. –  Matthew Aug 27 at 13:40

2 Answers 2

up vote 9 down vote accepted

The answer is usually yes if the value is only reflected if a valid CSRF token is provided - the user can only "attack" themselves in this instance.

However, if there is a form generated that correctly encodes output to a page that contains a CSRF token but then that form submits to a page that does not correctly encode output then your site is still vulnerable.

e.g. Original page (a GET request, which is not normally subject to CSRF tokens due to lack of side effects - only POSTs should cause side effects):-

www.example.com/displayForm.php?name=<script>alert('xss')</script>

contains

<input type="hidden" name="csrfToken" value"123456" />
<input type="hidden" name="name" value="&lt;script&gt;alert(&#039;xss&#039;)&lt;/script&gt;" />

However, when this page is submitted by POST, name is output unencoded:

<body>

Hello <script>alert('xss')</script>.

</body>
share|improve this answer
1  
True. But if that the server checks for valid CSRF token for every request (including the one where form.action points) it shouldn't be a problem, right? –  mg007 Aug 27 at 10:36
    
@mg007: Right. If in my above example the initial GET request required a token, then this attack would not be possible. However, CSRF tokens are usually only implemented for actions that have side-effects. –  SilverlightFox Aug 27 at 10:39
    
Thanks @SilverlightFox. –  mg007 Aug 27 at 10:49
    
BTW "including the one where form.action points" was supposed to be "including request for original page" :) –  mg007 Aug 27 at 10:52
    
@mg007: I got that. ;-) –  SilverlightFox Aug 27 at 10:53

Error pages can have reflected XSS vulnerabilities too, especially when any error trace includes input parameters. If a vulnerable error page is served when the CSRF token is not present, then your CSRF protection does not prevent reflected XSS.

share|improve this answer
    
Yes, that makes sense. Thanks :) –  mg007 Aug 29 at 10:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.