I have an application that executes under Tomcat 7, developed with Struts (Java Web Framework). My application contains a security vulnerability (XSS Cross-site scripting).

What kind of XSS vulnerability is it ?

  • Persistent (or stored)

How is it introduced and what is the context ?

  • Enter value in the textfield

What Java frameworks are you using ?

  • Struts 1.3

XSS is performed by the HTML code, which was introduced by a third party and is performed by the application. In the following example shows the vulnerability:

<html:text name="grupo" property="description" size="50" alt="Description"/>

enter image description here

After submit the form:

enter image description here

  • a CSP would help to mitigate if you can't update the app logic. – dandavis May 31 '18 at 19:46
  • Can you show us the code where the injected value is printed into the page (after you submit)? That's the relevant code. – Anders May 31 '18 at 21:31
  • The code I posted is on the JSP page. When you submit calls an action controller. The script in the text field in the image executes when you submit the form, and then displays the alert. I don’t know which code you’re refering to. – grf2018 May 31 '18 at 21:43

Don't know about Struts if it has some built-in protection, but you could escape (sanitize) the html tags, so that when the script tag is printed to the page, it won't be executed. You should put your sanitization code to the action controller where the form submits to.

Replace "<" character with &lt; and ">" with &gt;. After that script tags won't be executed.

OWASP XSS cheat sheet will help you to mitigate XSS vulnerabilities: https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet

Or as @dandavis commented: a CSP would help to mitigate if you can't update the app logic.

| improve this answer | |
  • Thank you for your reply, but the problem here is that I can't find a way to sanitize with that tag.<html:text ......./> – grf2018 May 31 '18 at 20:19
  • I edited my answer. – Aulis Ronkainen Jun 1 '18 at 3:19
  • Are you now able to sanitize the output? – Aulis Ronkainen Jun 4 '18 at 9:25
  • I m sanitize the ouput with JSTL, but not able to sanitize the input :/ – grf2018 Jun 5 '18 at 12:13
  • Sorry, but now you've lost me. What exactly do you mean by input and output? You should implement the sanitization code to the controller. That way whatever the user inputs to the form, the script tag won't get executed. How about adding the CSP header? Could that be a good method for you to mitigate this? – Aulis Ronkainen Jun 5 '18 at 19:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.