In one of the recent penetrationtests I encountered an XSS vulnerability within a cookie. The situation is as follows.
The webapplication uses the cookie to store the current URL. Once the user switches to another functionality within the application the cookies information is placed on the website as link. The created links are only valid for the current session.
So for example by manually setting the cookie to
Cookie: key=fooXbar results in
<a href="./foo">bar</a> where the
foo part is not validated but the
bar part is.
So when manually manipulating the cookie there is no validation on the
escape() seems to eliminate the chance to make this successfully exploitable (e.g.
So would there still be a possibility to inject XSS via the URL so that it gets properly included and executed? (Assuming there are no other vulnerabilities that could help exploiting this one.)
For now this would be rated as low finding due to the described circumstances. So any further comments or insight are much appreciated.
Thanks everybody for your feedback. According to the answers and the comments I currently believe that this xss vulnerability should not be exploitable by itself.
It is in fact the escape() function that is used. the
a links is crafted via php-script portion and the "./" portion is hardcoded. If I remember correctly it is build doing something in the lines of
$html .= '<li ...><a href="./' . $foo . ' " title="' . htmlspecialchars($bar) . '">';