2

When I add the HTTP header X-Forwarded-Host: bing.com, a meta tag is injected into the site:

<meta property="og:url" content="https://bing.com/argentina"/>

Does this have any security impact? Should I report this as a vulnerability?

XSS payloads could not get executed because the meta tag sanitizes ", < and >. What to do?

Improve this question

2 Answers 2

Reset to default
1

CVE-2017-8295 describes an issue in WordPress where the password reset mail is sent with the current host name as the sender. If an attacker requests the password reset mail with a forged host header, the password reset email is sent with the given domain as sender. If the email bounces, or the recipient replies, the reply is sent to the attacker. This reply contains the password reset token, thus making it possible to take over the account of the victim.

Improve this answer
0

Does this have any security impact?

The answer is 'possibly'. Anywhere you have a external data being injected into a webpage there is a risk of XSS, and this risk is mitigated both by the quality of the sanitization of the external data and the way the page has been constructed.

In general escaping or removing ", < and > is a decent start but many consider it to not be good enough because you are reliant on several things;

  • That all browsers parse attributes in the same way
  • That all character encodings parse attributes in the same way
  • That the template HTML will never change (e.g. someone updates the coding standards to use ' instead of ")
  • That some dynamic processing (for instance JavaScript) within this page doesn't use this data for different purposes and require different escaping.

According to Mozillas documentation for HTML meta tags you really ought to define an encoding for your content. Check the documentation specific to the sites HTML version as there may be slight variations.

Authors must not use CESU-8, UTF-7, BOCU-1 and/or SCSU as cross-site scripting attacks with these encodings have been demonstrated.

Authors should not use UTF-32 because not all HTML5 encoding algorithms can distinguish it from UTF-16.

It is strongly recommended to define the character encoding. If a page's encoding is undefined, cross-scripting techniques are possible, such as the UTF-7 fallback cross-scripting technique.

And should you report it? It certainly doesn't do any harm to flag up potential security issues even if it isn't currently an issue. It gives the site owner the ability to make their own judgement call on possible dangers.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .