1

Consider a website with an endpoint that, when a payload of an HTML string (full document or partial segment) is POST to it, the server will transform the payload (and sometimes no transform is applied) and return the transformed version of the input. What are the security concerns with this?

Further assumptions:

  • The content type does not need to be text/html (currently I have text/plain)
  • A user should be logged in and this can be validated
  • The site is loaded over SSL, no insecure resources loaded
  • This is already behind a referer-check filter to help mitigate CSRF

I don't think this will need to make it to a production environment but while I was considering the ramifications, I didn't come up with much so it piqued my interests.

  • Referer checks to prevent CSRF are problematic. See OWASP. – Anders Apr 20 '16 at 19:31
1

Assuming stored XSS were possible, the stored XSS could use the echo endpoint to present a phishing version of the site (since further XSS resource loading through the echo would be permitted and trusted due to the same origin it was coming from).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.