6

A former employee, put the following in our "global.axas"

if (url.Contains("xss")){
response.StatusCode = 404;
response.end();
}

I get he was trying to prevent cross site scripting, but other than example where people put alert('prevent xss');, what is the risk that he was trying to prevent?

The reason I'm asking is because we encrypt some data and the encrypted string contains the "...xss.." string, which is preventing the application from working as expected.

  • 7
    I would say the biggest risk that this former employee avoided with those 4 lines was being mistaken for a software developer who understands anything about web security. – Ghedipunk Aug 1 at 20:06
  • 2
    if anything, this actually makes it worse by exposing an out-of-pattern artifact. – dandavis Aug 1 at 20:39
  • Also, there’s a typo between the two responses. Could be more behind the scenes if you copied and pasted this. – alejandro5042 Aug 2 at 3:53
11

That is just cargo cult security filling no real purpose.

Any attacker who finds an XSS vulnerability could easily bypass that. Actually, probably they will never run into it the first place since there is no reason to include the name of the exploit in the payload. But if I discovered that any URL containing XSS resulted in a 404 I would be encouraged to explore more, since it is a sign that the people who wrote the application didn't know what they were doing.

While it provides no security, it does impact usability. There are a thousand different situations where you might legitimately have XSS in your URL (e.g. if you are base64 encoding anything).

  • 2
    I just want to add that attackers are trained to detect & bypass filters which are a lot more complex than this one, and it's native to think that attackers use xss in their exploits, since being undetected is often one of the main goals. – Benoit Esnard Aug 2 at 14:24
  • @BenoitEsnard Good point. Have updated my answer. – Anders Aug 2 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.