1

We did a vulnerability scan on our systems and received a vulnerability:

Basit Submit Module Cross Site Scripting Vulnerability.

We are not even aware of this application on our system. We filed a dispute and it was denied stating this:

If you are attempting to reproduce this issue you should be able to using the Burp Suite and it's repeater tool (available at http://portswigger.net/burp/):

GET /modules/Submit/index.php?op=pre&title=?"><script>alert('XSS')</script> HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:58.0) Gecko/20100101 Firefox/58.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: xxxx; FINGER_PRINT=xxxx; currencycode=USD; 
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

On accessing the url specified in the evidence, we get a 404 page. for eg. www.example.com/modules/Submit/index.php

How can we resolve this?

Improve this question

1 Answer 1

Reset to default
1

...we get a 404 page

My guess is that this 404 page includes the script given as argument and thus the 404 page itself is vulnerable to XSS.

How can we resolve this?

Nothing is known about your application so no specific fix can be recommended. But you should look into how you create your 404 pages. Likely you simply include the URL the user tried to access in plain (i.e. not HTML escaped) inside the error message which makes your 404 page a possible attack vector for XSS.

Improve this answer
9
  • How can I reproduce this using burpsuite?
    – user204082
    Commented May 10, 2019 at 5:25
  • @user204082: It is unclear what your knowledge is in this area so it is impossible to know how to help you. But to reproduce the issue with burp suite it might be useful that you make yourself first familiar what burp suite is, how it works and how one uses it. There is a lot of documentation out there about this. Depending on the relation you have with the ones who made the vulnerability scan they might you also provide more help in tackling the issue.
    – Steffen Ullrich
    Commented May 10, 2019 at 5:55
  • Okay. I just read about this: support.portswigger.net/customer/portal/articles/… I visited example.com/modules/Submit/index.php but there was no "Body" type field in my burp suite for this url in Repeater. So I edited the GET request from this: GET /modules/Submit/index.php? HTTP/1.1 to this GET /modules/Submit/index.php?op=pre&title=?"><script>alert('XSS')</script> HTTP/1.1
    – user204082
    Commented May 10, 2019 at 5:59
  • In the response section of the Repeater, I searched for the <script>alert('XSS')</script> and I got this with other bunch of responses, <link rel="canonical" href="https://www.example.com/modules/Submit/index.php?op=pre&title=?"><script>alert('XSS')</script>" /> <link rel="shortcut icon" type="image/x-icon" href="https://www.example/favicon.ico" /> Will this be considered a xss vulnerability?
    – user204082
    Commented May 10, 2019 at 6:03
  • 1
    @user204082: I have no idea what you are exactly doing nor what the contents of the response in full is. But I know (i.e. I've tried it) if I serve a page with the content you gave in the comment it will execute the script both in Firefox and Chrome if this is the only content and if content-type text/html was given even if status code is 404.
    – Steffen Ullrich
    Commented May 10, 2019 at 8:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .