3

I am wondering if I should report a reflected XSS vulnerability if it gets filtered by the XSS auditor of browsers.

For example, if I find an XSS vulnerability in www.website.tld/some-action/?productSku=tes"%20onload="alert(1), but the browser shows me the following auditor error: reflected xss

In my case the targeted website does not have the X-XSS-Protection header set, but most of the browsers enable XSS protection by default. I know I can try other things, like loading a malicious GIF file with JavaScript, but i'm just wondering if the onload=alert(1) above (which gets filtered) would also be considered a security issue, and why it would or wouldn't.

Improve this question

1 Answer 1

Reset to default
3

New bypasses for the xss auditor are found on a regular basis, and there are browsers like FireFox, which still lack a built-in XSS auditor. Reflective XSS needs to be fixed because it is a weakness in the operation of the application. Relying upon a 3rd party security system is... shaky at best.

When XSS is common place, other vulnerabilities follow.

Improve this answer
3
  • So if their bug bounty program states that reflected XSS needs to be reported, would you think that my example would indeed be categorized as reflected XSS?
    – Tijme
    Dec 11, 2016 at 18:45
  • @Tijme Yes 100%, try the same exploit in firefox.
    – rook
    Dec 11, 2016 at 18:52
  • I tried it in FireFox and it didn't work, but I forgot that the onload attribute doesn't trigger on divs. I tried it with onmouseover afterwards and it indeed works fine. Thanks!
    – Tijme
    Dec 11, 2016 at 18:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .