6

A former employee, put the following in our "global.axas" 

if (url.Contains("xss")){
response.StatusCode = 404;
response.end();
}

I get he was trying to prevent cross site scripting, but other than example where people put alert('prevent xss');, what is the risk that he was trying to prevent?

The reason I'm asking is because we encrypt some data and the encrypted string contains the "...xss.." string, which is preventing the application from working as expected.

Improve this question
3
  • 8
    I would say the biggest risk that this former employee avoided with those 4 lines was being mistaken for a software developer who understands anything about web security.
    – Ghedipunk
    Commented Aug 1, 2019 at 20:06
  • 2
    if anything, this actually makes it worse by exposing an out-of-pattern artifact.
    – dandavis
    Commented Aug 1, 2019 at 20:39
  • Also, there’s a typo between the two responses. Could be more behind the scenes if you copied and pasted this.
    – alejandro5042
    Commented Aug 2, 2019 at 3:53

1 Answer 1

Reset to default
11

That is just cargo cult security filling no real purpose.

Any attacker who finds an XSS vulnerability could easily bypass that. Actually, probably they will never run into it the first place since there is no reason to include the name of the exploit in the payload. But if I discovered that any URL containing XSS resulted in a 404 I would be encouraged to explore more, since it is a sign that the people who wrote the application didn't know what they were doing.

While it provides no security, it does impact usability. There are a thousand different situations where you might legitimately have XSS in your URL (e.g. if you are base64 encoding anything).

Improve this answer
2
  • 2
    I just want to add that attackers are trained to detect & bypass filters which are a lot more complex than this one, and it's native to think that attackers use xss in their exploits, since being undetected is often one of the main goals.
    – Benoit Esnard
    Commented Aug 2, 2019 at 14:24
  • @BenoitEsnard Good point. Have updated my answer.
    – Anders
    Commented Aug 2, 2019 at 14:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .