2

I've come across an API of a web application I'm testing, which reflects with unescaped, unencoded, user-controlled data for some requests. However, the response includes the header Content-Type: application/json;charset=UTF-8.

The response body is simply a JSON, like the following:

{"name":"foo","title":"bar"}

I did try to perform a simple XSS (classic <script>alert(1)</script>), but the script isn't executed.

{"name":"<script>alert(1)</script>","title":"bar"}

I've read through this question, but they do not seem to discuss the impact of the content-type header. OWASP seems to flag the reponse-type as "good" in this article.

My question is if the Content-Type header in the response has an impact on the exploitability of XSS and possibly other vulnerabilities?

2

My question is if the Content-Type header in the response has an impact on the exploitability of XSS and possibly other vulnerabilities?

Yes, the content type makes a difference. XSS only applies to documents that are capable of running active (script) content in the first place.

A page with the MIME type application/json can't contain active content. To the browser it's just data. The situation would be similar with text/plain, text/javascript, image/jpeg, etc.

XSS would be possible with a MIME type of e.g. text/html, image/svg+xml, text/xml and many others. In some cases, vendor-related types such as application/x-shockwave-flash may have an XSS potential, too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.