1

I have an application that executes under Tomcat 7, developed with Struts (Java Web Framework). My application contains a security vulnerability (XSS Cross-site scripting).

What kind of XSS vulnerability is it ?

  • Persistent (or stored)

How is it introduced and what is the context ?

  • Enter value in the textfield

What Java frameworks are you using ?

  • Struts 1.3

XSS is performed by the HTML code, which was introduced by a third party and is performed by the application. In the following example shows the vulnerability:

<html:text name="grupo" property="description" size="50" alt="Description"/>

enter image description here

After submit the form:

enter image description here

Improve this question
3
  • a CSP would help to mitigate if you can't update the app logic.
    – dandavis
    Commented May 31, 2018 at 19:46
  • Can you show us the code where the injected value is printed into the page (after you submit)? That's the relevant code.
    – Anders
    Commented May 31, 2018 at 21:31
  • The code I posted is on the JSP page. When you submit calls an action controller. The script in the text field in the image executes when you submit the form, and then displays the alert. I don’t know which code you’re refering to.
    – grf2018
    Commented May 31, 2018 at 21:43

1 Answer 1

Reset to default
1

Don't know about Struts if it has some built-in protection, but you could escape (sanitize) the html tags, so that when the script tag is printed to the page, it won't be executed. You should put your sanitization code to the action controller where the form submits to.

Replace "<" character with &lt; and ">" with &gt;. After that script tags won't be executed.

OWASP XSS cheat sheet will help you to mitigate XSS vulnerabilities: https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet

Or as @dandavis commented: a CSP would help to mitigate if you can't update the app logic.

Improve this answer
7
  • Thank you for your reply, but the problem here is that I can't find a way to sanitize with that tag.<html:text ......./>
    – grf2018
    Commented May 31, 2018 at 20:19
  • I edited my answer.
    – Aulis Ronkainen
    Commented Jun 1, 2018 at 3:19
  • Are you now able to sanitize the output?
    – Aulis Ronkainen
    Commented Jun 4, 2018 at 9:25
  • I m sanitize the ouput with JSTL, but not able to sanitize the input :/
    – grf2018
    Commented Jun 5, 2018 at 12:13
  • Sorry, but now you've lost me. What exactly do you mean by input and output? You should implement the sanitization code to the controller. That way whatever the user inputs to the form, the script tag won't get executed. How about adding the CSP header? Could that be a good method for you to mitigate this?
    – Aulis Ronkainen
    Commented Jun 5, 2018 at 19:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .