XSS on reflecting parameter

Question

A website reflects the parameter I send, but the user input is accepted in the form of string.

Hence whatever I search is reflected as

<meta property="og:title" content="hello _userinput_ to xyz" />

in the source code.

I tried to end the string sequence with " but the " character is filtered using &quot

So the above code becomes

<meta property="og:title" content="hello &quot; to xyz" />

Also I noticed that certain keywords like > returns >

I also tried to start from newline using the # character, but that gives me a 400 bad request.

Now, because my input is getting reflected in the page, I thought I could carry out an XSS attack.

Is it possible to escape the string and execute any script there?

Answer 1

Just because user-entered text is reflected into a page doesn't automatically mean there is an XSS vulnerability; a lot of websites require this type of functionality.

From what I see, it looks like the website is properly HTML-encoding your input, so characters are returned in a safe format that render correctly but do not affect the surrounding HTML. However, you have to be careful when putting user input into an attribute, and there could be mistakes with the filtering/encoding. See the OWASP XSS prevention cheat sheet:

Except for alphanumeric characters, escape all characters with ASCII values less than 256 with the &#xHH; format (or a named entity if available) to prevent switching out of the attribute.

So, you could keep trying other characters until it breaks.

That's the main reason it's probably not going to work, but there could be other preventions in place as well (e.g. Content Security Policy).