0

Is there a way to calculate/estimate the complexity of an XSS vector?

I would like to consider a "XSS-vector complexity score" in the risk = likelihood * impact formula1. In my opinion the likelihood increases when the "XSS-vector complexity score" decreases and visa-versa.

For example, an very easy XSS-vector would be:

<script>alert(1);</script>`

A more complex XSS-vector would be2 :

<div style=overflow:-webkit-marquee onscroll=alert(1)>`

or 3

<script/%00%00v%00%00>alert(123)</script>`

1. OWASP Risk Rating Methodology.

2. Source: twitter.com, works only in Safari

3. Source: twitter.com, IE XSS filter bypass

  • 1
    "In my opinion the likelihood increases when the "XSS-vector complexity score" decreases and visa-versa." why? It's either exploitable, or not. Probably not much in between. – CodesInChaos Jul 11 '16 at 21:29
  • @CodesInChaos I agree. But a easy XSS-vector is likely to be found easier by an attacker than a highly complex one. Or one that's on a known XSS-vector list or included in automated XSS-tests. Those are more likely to be found and misused I suppose. And so, the impact of XSS should stay the same (just considering if it's after authentication or before) but the likelihood is I think related the CSS complexity. – Bob Ortiz Jul 11 '16 at 21:34
5

I'd suggest that trying to apply numeric values to abstract constructs like "risk", "impact" and "likelihood" isn't likely to be a great idea.

The problem is that each of these terms tends to be both subjective (what's likely to one person isn't likely to another) and extremely situational (the impact of XSS on one site will be likely different to another), so realistically there's very limited use in doing it (apart from to appease management who insist on quantification and ranking of things)

You can see loads of examples of these kinds of problems where people try to quantify vulnerabilities. A good example with CVSS is this.

Having an open telnet port (an entirely unencrypted service) is CVSS 4 according to Rapid7 or perhaps 5.8 if you listen to Tenable , so obviously subjective as it's the same issue. Then for added fun you can compare to having a self-signed certificate, which whilst not always ideal, is better than no encryption at all, but Tenable rate this as CVSS 6.4 , so higher severity than no encryption at all ! (Rapid7 has this one as 4)

Given that people can't even agree on consistent ratings for identical findings, I'd recommend against trying to rank things like XSS which have a much greater variety to them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.