I run a vulnerability scanner on my website which showed me a couple of vulnerabilities which look like this:
http://.../search?text=&ClassIDNames[37]=<script>alert('Found')</script>&ActiveFacet[ClassID]=37
but when copying the url to the browser it does not give me the alert output but the search result for the corresponding input. Is this anything I have to fix or is it nothing to worry about? Or do I have to do anything else to reproduce it somehow?
Some scanners simply search for the injected string ("found" in this case) somewhere on the page, if "found" is in the search results, then it would classify it as a positive finding.
If the XSS string is being interpreted as a string in the search function (literally searching for the string <script>alert('Found')</script>, then you can chalk it up as a false positive - the scanner saw its own injected string in the resulting page.
<a href="/search?text="><script>alert('Found')</script>
Your source content <a href="/search?text="><script>alert('Found')</script> seems to show that your application is vulnerable to XSS. I think your browser is just mitigating the injection because it detects that it's inline javascript.
Maybe you are using a framework that is sending to your browser some mitigation headers. Look at the OWASP useful HTTP headers and particularly the X-XSS-Protection and Content security policy : https://www.owasp.org/index.php/List_of_useful_HTTP_headers.
As some browser (the old ones) will not honor those headers, I strongly suggest you to sanitize properly every input and not to rely on those mitigation solutions.
You have a really good and complete guide for preventing XSS on https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
Cheers.
Perhaps the the XSS-code ended up inside a tag of which the contents are interpreted as text-only, such as <title> or <textarea>. Try prepending the XSS code with </textarea> or </title> if this is the case.
It may also have ended up in an attribute of an element, in which case you need to close the attribute and element using "> or '>
Normally vulnerabilities in the website can be done manually and using scanner tools.First determine the vulnerabilities using the Scanner tools and then check for False Positive, means verifying the scanning results. While verifying manually if the issue is not found then it is False Positived means it will be eliminated. In case like XSS the browser may prevent or filter out the XSS.Try with disabling the XSS filter in the browser.If there is no issues then no need to worry about this vulnerability.
Vulnerabilites determined by the scanner is not the accurate one anyway we have to cross check each and every vulnerable paramaters and url which is shown in the scanner.
Scanner may also left some vulnerablities in some cases for that we have to manually check through the website.
While verifying the result of the scanner,by copying the url to the browser,if it does not give the alert then it can be said as a False positive finding. The browsers like Chrome,Firefox,IE can also block the XSS.
Inorder to disable this filter in firefox and IE read this article:https://www.phillips321.co.uk/2012/03/01/xss-browser-filters-disabling-it-for-app-testing/
Inorder to prevent Xss vulnerability use can go through https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
Are you doing it in Chrome? Chrome has an XSS auditor which can block a lot of XSS attacks. If you are in Chrome, you can open the Developer Tools window and it will show when XSS attacks are blocked.
You may also want to try a different browser like IE.
