1

What's the difference between Reflected XSS (RXSS) and Reflected-DOM XSS (RDOMXSS)? After some research, I think it can be concluded that Reflected-DOM XSS is:

Similarities:

  1. The value is reflected by the target application

Characteristics That Are Present in RDOMXSS and Not In RXSS:

  1. Does not use include any HTML tags such as <img> or <script>
  2. Directly reflected into a JavaScript Block/JavaScript Event Handler (onload/onbody/etc.)
  3. Reflected into a HTML tag - Example <input id="vuln" value="Injected"> where insecure JavaScript performs an insecure operation such as eval(document.getElementById("vuln"));

Questions:

  1. Is Data Reflected In JavaScript Block (XSS) considered as RDOMXSS? Injecting "; eval(alert(document.domain));// results in an alert.
<script>
  var a = "<XSS Injection>";
</script>
  1. Is Data Reflected In JavaScript Handlers (XSS) Like onload/onerror/onclick considered as RDOMXSS? Injecting alert(document.domain) results in an alert.
<body onload="<XSS Injection>"></body>
  1. Is Data Reflected In a HTML Tag <input id="vuln" value="Injected"> where insecure JavaScript performs an insecure operation such as eval(document.getElementById("vuln")); considered as RDOMXSS? Injecting alert(document.domain) results in an alert.
<input id="123" value="<XSS Injection>">

<script>
    eval(document.getElementById("123").value);
</script>

Appendix

What is a Document Object Model - https://www.w3.org/TR/WD-DOM/introduction.html

The Document Object Model (DOM) is a programming API for HTML and XML documents. It defines the logical structure of documents and the way a document is accessed and manipulated. With the Document Object Model, programmers can create and build documents, navigate their structure, and add, modify, or delete elements and content. Anything found in an HTML or XML document can be accessed, changed, deleted, or added using the Document Object Model.

What is a HTML DOM - https://www.w3schools.com/js/js_htmldom.asp

The HTML DOM is a standard object model and programming interface for HTML. It defines:

  • The HTML elements as objects
  • The properties of all HTML elements
  • The methods to access all HTML elements
  • The events for all HTML elements

From Question 1 (What is a Document Object Model), The Document Object Model (DOM) is a programming API for HTML and XML documents. which JavaScript is a subset of DOM.

From Question 2 (What is a HTML DOM), HTML DOM is a standard object model and programming interface for HTML. It defines The events for all HTML elements which includes onload/onclick/onerror. In other words: The HTML DOM is a standard for how to get, change, add, or delete HTML elements.

Note: Do not confuse the line "The HTML elements as objects" as "HTML Tags", to extrapolate, it means, "A HTML DOM is an object model and programming interface which defines HTML elements AS OBJECTS which can be accessed, changed, deleted, or added using the Document Object Model".

Improve this question

2 Answers 2

Reset to default
0

Your "differences" section does not clearly indicate which type each line applies to, so I can't really tell you what exactly is and isn't correct about each of them. You also don't link to any sources that talk about "RDOMXSS". However, I can say this much:

  1. To a first approximation, there is no such category as "reflected-DOM XSS". I mean, I can make a guess at specifically what it means, but I've never heard the term before, and the distinction between it and "normal" DOM-based XSS isn't very relevant.
  2. Reflected XSS (r-XSS) is any time attacker-controlled content is returned directly from the web server in a way that is, or can become, an executable context (usually HTML, sometimes SVG, sometimes script that is being loaded within HTML, rarely objects, etc.). It doesn't matter at all whether the reflected content is injected into a script block directly, or into an HTML attribute, or into what is expected to be plain text between HTML tags, or even if the reflection forms the entire HTML document. All of those are considered r-XSS. Note that most of these are "reflected into the DOM" in some sense; that does NOT make them DOM-based XSS.
  3. DOM-based XSS (DOM-XSS) is when client-side script loads some content from a non-executable context into an executable one. Traditionally, the source of this content was the URL (possibly the fragment, which doesn't get sent to the server at all) and the destination was the DOM (via either DOM-manipulation functions such as appendChild, or via things like document.write), hence the name. However, DOM-XSS can also apply when content comes from the server (e.g. JSON, YAML, or XML) in response to a script-initiated request and the script takes that request body and puts it in an executable context unsafely. DOM-XSS can also occur where the content starts out in the DOM but in a non-executable way and a script makes it executable (as in your example, where the executable context in question is "a string passed to eval). On the other hand, DOM-XSS can occur even when the content isn't ever put into the DOM at all (despite the name); e.g. if a script evals the URL fragment.
  4. Given those definitions, "reflected-DOM XSS" might mean "XSS where the content is supplied in the initial request, reflects off a server response but in a safe way, and is then made to execute because of a client side script". Thus, your example of evaling the content of an input element could qualify, if that content were supplied in the request and reflected in the response. Or it might mean something else (in the mind of whoever coined the term); it's hard to tell when you consider how little names in this space mean (consider that "cross-site scripting" is itself often a misnomer; some of the most famous XSS attacks were actually same-site, such as the Samy worm that spread across MySpace).
  5. The definition given in #4 is a distinction without a difference, though. The problem isn't the reflection, nor is that the logical place to fix the issue. The problem is the unsafe handling of untrusted content by the client-side script, and that is where the fix needs to live. This is, not coincidentally, the same remedy recommended for all DOM-XSS.

Hope that helps. If you have additional information about this type of XSS that somebody has felt the need to put a name to, I'd be interested to see it (and may update this answer in response).

Improve this answer
1
  • Hey! The only link/article regarding Reflected DOM XSS is https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-dom-xss-reflected. I've edited the differences section and I've given some examples in the questions section, thanks!
    – NoPurposeInLife
    Aug 15, 2022 at 9:11
0

  1. No - reflection into JavaScript is reflective XSS. It is in a JavaScript context, but the issue occurs during server-side rendering.

  2. No - as (1)

  3. Yes this is reflective, DOM-based XSS. There's no issue with the server-side rendering, but the client-side code causes a vulnerability.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.