2

I have a Qualys web application scan report that says I have a XSS vulnerability. It explains this was detected by requesting a malicious payload and evaluating the response.

When I make the same request, I'm getting a different response that doesn't appear vulnerable.

The request: https://my.site/asection/Some%20Param?"><qss>=

Response the scanner gets:

<a href="/asection/index.cfm?param=A Different Param&"><qss>=" class="current">

Response I get:

 <a href="/asection/index.cfm?param=Some Param&%22%3E%3Cqss%3E=" class="current">

Why can't I duplicate the scanner's results? What do I need to do to get a clean scan?

EDIT: Thanks for the advice, all. I'm afraid I'm still stumped here. I've tried making the request from a browser, from python via requests and from wget with the same results (shown above). The headers I'm seeing from Qualys: enter image description here

GET https://my.site/asection/Some%20%20Param?"><qss>=
Referer: http://my.site/
Cookie: JSESSIONID=48BBDB43C2DAF217644045004E3AF105.cfusion; CFTOKEN=4e91b60205baf756-E6723476-DAFC-BF6E-EB44114CE65CBF13; CFID=7001629;
Host: my.site
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/601.4.4 (KHTML, like Gecko) Version/9.0.3 Safari/601.4.4
Accept: */*

and the headers I'm seeing with wget (via wget -d "https://my.site/asection/Some%20Param?\"><qss>="

GET /asection/Some%20Param?%3E%3Cqss%3E=%0A HTTP/1.1                                                            
Referer: http://my.site/
Cookie: JSESSIONID=48BBDB43C2DAF217644045004E3AF105.cfusion; CFTOKEN=4e91b60205baf756-E6723476-DAFC-BF6E-EB44114CE65CBF13; CFID=7001629;   
Host: my.site
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/601.4.4 (KHTML, like Gecko) Version/9.0.3 Safari/601.4.4                                                                                                                
Accept: */*                                                                                                             
Accept-Encoding: identity                                                                                               
Connection: Keep-Alive                                                                                                  

I've re-run the scan and it still detects the vulnerability. I've reviewed Why isn't this XSS working?. Are all of my requests getting returned URL Encoded? Is there a tool (or a flag in wget/requests) that will let me suppress this to see the raw response or the decoded response?

  • Do you use the same headers as Qualys scanner do? Make sure You are reproducing full HTTP request, not just the URL one – RedS Sep 18 at 20:57
  • 2
    Possible duplicate of Why isn't this XSS working? It's not an exact duplicate, but I'm quite sure the answer applies to your case too. – Arminius Sep 18 at 21:02
  • How are you sending such request? Maybe with a browser that contains an anti-XSS? – Ángel Sep 18 at 21:05
  • Try the URL via cURL or wget in a terminal of whatever OS you are using - the response looks the same except that your browser is encoding your request – LTPCGO Sep 18 at 23:16
1

Your header is of course showing it in URI encoding because it's a URI. You need to look at the actual body - your report stated it was in an a tag, so look for that a tag. Pass your output through grep and it should fall out. You won't see it in a GET because that is the data you are sending to the server (or directly what the server is receiving, either way)

  • Could you clarify how to "look at the actual body." I was under the impression that the methods I was using (browser, wget, python requests) were displaying the response body (a snippet of which I included in the "Response I get" section of the post.) I only put the headers into my post to demonstrate if the headers on my requests were comparable to the headers in the scanner's request. – roms Sep 24 at 14:48
  • Hmmmm, I did mean the response body, from curl/wget etc. Not sure now, complete guess but maybe something with the -d flag makes is altering it - you do show the request headers directly from the terminal, right? How does qualys display theirs? – LTPCGO Sep 24 at 15:58
  • updated post with a picture of the qualys headers. The results of wget -d and wget both have the same response: <a href="/asection/index.cfm?param=Some Param&%22%3E%3Cqss%3E=" class="current"> – roms Sep 24 at 17:11
  • It could be how they process their info then, it might be a bug in how it's reported - best off reaching out to Qualys perhaps – LTPCGO Sep 24 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.