Is this reflected or DOM-based XSS?

Question

Scenario:

Server-side script takes URL parameter parameter1 and writes it without encoding into cookie cookie1. Then regular HTML page containing client-side script is returned.

Client-side script, when user triggers an action, takes a value stored in cookie cookie1 and inserts it without any processing as HTML content of a paragraph.

How to classify this XSS? On one hand, payload reaches the server and server-side code can encode user supplied data before putting it into a cookie. On the other hand, insecure DOM manipulation is another reason of XSS occuring. Could you please clarify the distinction between reflected and DOM-based XSS on this particular example?

Answer 1

DOM based if you're basing it on the stored/reflected/DOM classification system.

From OWASP Types of Cross-Site Scripting:

DOM Based XSS is a form of XSS where the entire tainted data flow from source to sink takes place in the browser, i.e., the source of the data is in the DOM, the sink is also in the DOM, and the data flow never leaves the browser.

Here the source of the data is document.cookie and the sink is also in the DOM (HTML content of a paragraph).

However, classifying XSS in such a way really only boils down to semantics, as the article notes:

For years, most people thought of these (Stored, Reflected, DOM) as three different types of XSS, but in reality, they overlap. You can have both Stored and Reflected DOM Based XSS.

Using the above I guess you could classify it as "Reflected DOM Based".

OWASP have attempted to try and get people to reclassify XSS as either server based or client based, where DOM XSS is a subset of Client XSS. Using this system it would be a "Reflected Client XSS" vulnerability.

Regardless of actual classification, the vulnerability here is in the DOM rather than the cookie storage as there is no need to HTML encode for storage into a cookie. Encoding should be done as late as possible when the usage context is known otherwise this cookie could have been poisoned.

e.g.

1. Website is on example.com and it normally only listens on HTTPS.
2. Attacker Man-In-The-Middles an HTTP connection from their victim and sends them to example.com over plain HTTP. The HTTP server in this case is the attacker's.
3. Attacker sets the cookie containing some script code.
4. The victim later visits the real example.com over HTTPS and the XSS is triggered.

As the code that adds the text to the DOM is not correctly HTML encoding, this is a DOM based XSS attack. As you can see from the above example, not HTML encoding on storage into the cookie doesn't stop the above attack scenario.