3

I am wondering if I should report a reflected XSS vulnerability if it gets filtered by the XSS auditor of browsers.

For example, if I find an XSS vulnerability in www.website.tld/some-action/?productSku=tes"%20onload="alert(1), but the browser shows me the following auditor error: reflected xss

In my case the targeted website does not have the X-XSS-Protection header set, but most of the browsers enable XSS protection by default. I know I can try other things, like loading a malicious GIF file with JavaScript, but i'm just wondering if the onload=alert(1) above (which gets filtered) would also be considered a security issue, and why it would or wouldn't.

3

New bypasses for the xss auditor are found on a regular basis, and there are browsers like FireFox, which still lack a built-in XSS auditor. Reflective XSS needs to be fixed because it is a weakness in the operation of the application. Relying upon a 3rd party security system is... shaky at best.

When XSS is common place, other vulnerabilities follow.

  • So if their bug bounty program states that reflected XSS needs to be reported, would you think that my example would indeed be categorized as reflected XSS? – Tijme Dec 11 '16 at 18:45
  • @Tijme Yes 100%, try the same exploit in firefox. – rook Dec 11 '16 at 18:52
  • I tried it in FireFox and it didn't work, but I forgot that the onload attribute doesn't trigger on divs. I tried it with onmouseover afterwards and it indeed works fine. Thanks! – Tijme Dec 11 '16 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.