2

Scenario: publicserver.com is a publicly accessible web application, which does not filter input, allowing javascript/XSS attacks to be stored in the database.

privateserver.lan is only accessible from the inside of a firewall, on a private LAN, and not accessible from the internet. It has a limited audience. privateserver.lan reads data from the publicly accessible servers DB (publicserver.com), and does not properly filter output, allowing Stored XSS.

Barring any intentional attacks from users with direct access to privateserver.lan, what are the XSS risks to the data on privateserver.lan, and to the users of privateserver.lan, keeping in mind that outside users are unable to gain access to this server through the firewall?

Also, to be clear, this is something We will be fixing, I'm only trying to assess the risk to determine the priority of the fix.

Improve this question
2

XSS doesn't run on the attacker's computer; it runs on the target's. Thus, the fact that public internet attackers cannot access the internal site where the attack happens is irrelevant.

As an example, imagine this scenario:

  1. Attacker adds XSS into the database via publicserver.com.
  2. Company employee visits vulnerable page on privateserver.lan.
  3. Employee is hit by XSS attack.

This attack could grab sensitive cookie information and send it to the attacker's external server. Or maybe it queries a number of local IPs looking for vulnerable servers, then sends that information out to the attacker (who makes use of that to update the XSS to attack those servers). There are any number of attacks that can happen, and merely being inside the local network while the attack happens doesn't protect you very much.

This is one of the reasons you might consider configuring egress rules into your firewall, rather than only blocking incoming traffic.

This is a very valid vulnerability.

Improve this answer
  • Hi, you give the example that someone could grab sensitive cookie information, but wouldn't the cookie only be for privateserver.lan? Am I correct in believing that the attacker could not get cookie information for publicserver.com, google.com, or anything other than privateserver.lan? – Danny F Jan 21 '17 at 1:24
  • I hit Enter too soon on my last comment. Also, I understand that the XSS attack is perpetrated against the target/end user's computer/browser, not on the server itself. My reasoning for asking about this scenario is because I believe the attacker is severely limited in terms of what they can gather from privateserver.lan with this attack, due to being inaccessible by the attacker. I'm trying to prove or disprove that belief, and get an understanding of what attacks are still possible, and particularly if there are any that result in gathering data from privateserver.lan. Thanks! – Danny F Jan 21 '17 at 1:36
  • Several of the examples I listed still make sense in that context. Also, theoretically the attacker could execute any sort of API call in the internal application, through stored XSS... so they could do whatever administrative thing your internal users can do. They don't have direct access, but they have indirect access through the XSS. – Xiong Chiamiov Jan 21 '17 at 5:14
0

Let's assume x is the attacker and e is an employee of the company

  1. x made a malicious redirection to his website which will be designed like the company website or privateserver.lan
  2. e go to x's website
    Enters credentials or downloads a script [malware]
  3. x uses the malware to access privateserver.lan

Finally:
The XSS can lead to social engineering, redirecting, session hijacking, etc

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.