0

If I have a web app that is vulnerable to XSS in the url (reflected XSS), does CSP protect against this type of XSS?

Ex: when I run www.example.com/<script>alert(1);</script> in the browser, this will trigger a popup message.

Improve this question
1
  • If that is being executed, you have other more serious issues that can't be fixed by CSP configuration.
    – schroeder ♦
    Commented Mar 11 at 16:47

2 Answers 2

Reset to default
5

Browsers do not magically execute JavaScript code embedded in the URL path. By itself, the path is just data. If the code from your example is executed, there's a fundamental problem either in the server-side or the client-side application code. Some component fetches the path and inserts it into the page in a way that JavaScript code execution is triggered. This part is what you need to find and fix.

The vulnerability is rather unusual, so I strongly recommend you actually investigate the vulnerability and do not rely on CSP as a workaround.

  • If this is a client-side (JavaScript) problem, it's odd that the script content even gets executed. In modern browsers, script elements inserted using innerHTML do not execute when they are inserted, and other JavaScript methods like setHTML sanitize the input. So either you're using a very old browser, or the application code is doing extra steps to be vulnerable, e.g., it calls eval with untrusted data.
  • If the problem is server-side, it's strange that such a nonsensical path leads to anything other than a 404 error -- unless the vulnerability is on the 404 page itself. In any case, the attack would indicate a complete lack of HTML-escaping.

None of this can be fixed with CSP. CSP is not a replacement for correct code. It's a last-ditch effort in modern browsers to temporarily stop XSS attacks until the vulnerability has been fixed. In this particular case, it would likely catch the attack, but this

  1. isn't guaranteed until you've identified the actual vulnerability and confirmed that CSP covers this case
  2. doesn't solve the underlying problem
  3. doesn't work in all browsers
  4. depends on a correct configuration -- which is questionable given the major problem with the code itself
Improve this answer
2
  • I am not using an old browser. And to be precise, the example I gave is a bit vague, the XSS script is on a rest endpoint, so it is example.com/static/iam/authz. When i add the script after authz/, I get the script executed, then when I click ok I get an error message displayed related to the API exposed. The same error I get when I click on the link without the injected script.
    – anonymous
    Commented Mar 12 at 8:13
  • Like I said, there's something seriously wrong with the application, but we cannot investigate that for you without the exact code. If you have access to the source code, it shouldn't be too difficult to find the part which inserts the (sub-)path into the page. If you don't have access, then report the vulnerability to whoever is responsible for security incidents.
    – Ja1024
    Commented Mar 12 at 11:55
0

The source of the XSS script (e.g. URL or database) does not matter for CSP. A good CSP can protect against most XSS vulnerabilities, but not all. For example, a CSS that does not allow unsafe-inline would prevent you against reflecting the XSS snippet in the html file or inserting it via innerHTML. However, you could still be vulnerable if your server e.g. serves a JavaScript file dynamically and somehow includes the XSS script there.

Improve this answer
4
  • Thank you for the explanation, but still it doesn't answer my question, because in my case the script is directly injected in the url, so there is no source of the script. Does or is there a way to prevent XSS if it is directly injected in the url, using CSP ?
    – anonymous
    Commented Mar 11 at 14:23
  • 1
    The script being present in the URL like in your example does nothing on its own, it won't get executed. Only if some frontend or backend code reflects it from the URL into somewhere (like a HTML document, a javascript asset, or the DOM), it gets executed. And these places are the ones you can restrict using the CSP
    – Yogu
    Commented Mar 11 at 15:57
  • so in my case how is it getting executed ? because once I run the url in the browser it is being executed directly. According to CSP, what i understood so far is that I can block using javascripts from another origin, in my case even I do that, the script will still be consumed since it is being passed through the url.
    – anonymous
    Commented Mar 11 at 16:13
  • 2
    @anonymous Scripts in the URL using the format you demonstrate are never executed automatically. If they execute on your site, it's because either your server or a script running on your page is reading them out of the URL and dynamically adding them to the page response / an external script loaded from the page / the DOM. This is fantastically unsafe, of course. CSP can prevent it, but only if you're adding them to the page/DOM, and only by blocking execution of inline scripts in the page. It can't keep you from shooting your foot off if you try very hard, though.
    – CBHacking
    Commented Mar 11 at 16:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .