Recently, I have come across a reported XSS where the attacker is Unicode encoding the payload in HTTP GET parameters to evade existing XSS filter -
My question is - when does the Server/application convert the Unicode to plain text? Is it upon reading the values of GET parameters? If yes, then why not the filter is able to detect it?
The attack is not working, when the same payload is provided in plaintext. App is deployed on IIS 7.
Any mitigation strategy for this type of evasion technique will also be appriciated.
UPDATE: https://www.ietf.org/rfc/rfc1738.txt restricts the use of unicode chars as URLs. what are the chances that IIS 7 still accepts unicode chars as part of URL GET values. I have some vulnerable php webapps for testing (DVWA, deployed in WAMP server) which are easily vulnerable to very simple XSS attack vectors like <script>alert(1)</script>
. I tried replacing few characters with their Unicode equivalent but that encoded string doesn’t invoke XSS!!!
%u00
can stop it. Since non-english users won't encode chars all weird like that, nobody should miss the un-escaped fall-throughs.