I need to block redirection using window.location on my site. Some hacker has injected a stored XSS script into my site:

if(my_username != 'Name') window.location = 'https://the url'; 

Now each time a user logs in, he gets redirected in seconds. This script can be blocked by using:

window.onbeforeunload = function() {return "Some message"}

But the problem is, the hacker has deployed a bot which auto sends this script every 5 seconds. And obviously the hacker's bot itself doesn't get redirected even though it doesn't match the if condition. So probably he's blocking it.

How can I block it in the same way?

The bot also sends a similar XSS CSS script body {display: none;}. It's easy to reverse it with document.body.style.display="block".

Now there has to be a similar way to block window.location permanently without having to press cancel each time the bot sends it because of window.onbeforeunload.

  • 6
    I think you would be better off trying to find out how the XSS is injected and plug that hole! If you somehow block window.location the attacker will just come up with something else. – Anders Jul 5 '19 at 8:33

Fix your XSS Vulnerability!

I'm really just repeating Ander's comment, but it is the only correct answer so I'm posting it as an answer.

You are suffering from the X-Y problem. You don't want to stop an attacker from using window.location. You need to find and plug your XSS vulnerability, remove all stored XSS from your system, and hope he didn't use other XSS to steal your admin credentials for the system.

If you somehow figure out how to block window.location the attacker can simply deploy a new payload that might cause even more trouble. Once someone has managed to execute arbitrary javascript on your website it's a losing game. The only option is to keep them out.

Implement a CSP (content security policy)

If you need a "quick" fix in place to mitigate the damage from XSS while you find and plug the hole, you can attempt to implement a strict CSP. If done properly a CSP may be able to stop your attackers payload from running altogether. Note that this is not a fool-proof solution, as CSPs can have their own challenges - depending on how you have your site setup, you may block your own scripts, and depending on how the stored XSS payload is injected into your page, it may be hard to get a CSP to block it. Also, the CSP header isn't supported by all browsers. In general though a strict CSP can bring XSS to a screeching halt though, so it is absolutely worth implementing.

As a quick explanation, a CSP is a header you send down with the page which sets rules for the browser about what/where/how assets (including javascript, css, etc...) can be loaded and executed. A very strict CSP would tell the browser that only files loaded directly from the server's domain can be executed. This almost completely kills all forms of XSS because in 99% of cases the XSS payload is added to the page inline rather than being loaded as a separate asset from the server. However, implementing that strict of a CSP also requires that you not have any inline-javascript/css yourself, which is quite easy with many modern frameworks, but may not work as well if you have a different setup, declare javascript directly on the page, etc... However the rules around CSPs are very flexible so you should be able to find something that will make life harder for hackers while not getting in your way toooo much.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy