2

A typical ajax call:

$.ajax({
  url: "http://mywebsite/script?param=" + $("#field").val(),
  dataType: "jsonp",
  success: function(response) {
      $("#id").html(response);
  },
 });

sends a parameter . The parameter is filtered and sanitised on the server side. The server returns a simple text response that is used to be displayed on the HTML page. However it is possible to intercept the response and include tag. Because the code uses $("#id").html(response) to display the response, the modified response, including content will be executed .

As this occurs only when the server response is manipulated and before displayed on client, is this vulnerable to XSS ? How can this be exploited ?

As preventive method is it better to use $("#id").text(response); instead of $("#id").html(response) to ensure the response string, even when intercepted, is displayed as text ?

  • Man-in-the-Middle scenarios do not qualify as XSS vulnerabilities. If someone could modify the response then they could also modify the page itself. – Jonathan Gray Jan 1 '16 at 1:03
2

You have not given us enough information to determine if this is vulnerable to XSS. XSS occurs when a user input is displayed in a browser without proper escaping. For example:

$.ajax({
  $("#id").html($("#field").val());
 });

is vulnerable because the input value from #fieldis displayed in the browser without escaping.

If we look at your example:

$.ajax({
  url: "http://mywebsite/script?param=" + $("#field").val(),
  dataType: "jsonp",
  success: function(response) {
      $("#id").html(response);
  },
 });

a vulnerability exists if response contains all or parts of #field's unescaped value. If response can only contain constant strings such as OK and Error, or if there was proper HTML escaping done on the user input, then you are secure. Otherwise, you have a vulnerability.

  • The $("#field").val() is escaped and sanitized on the server side. The response contains the sanitised value ( can even contain OK) . Can this response be exploited ? Should be better to have on client side $("#id").text(response) instead $("#id").html(response) to ensure strings are displayed as intended ? – GearLab Dec 31 '15 at 12:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.