I have an web app which can used via an browser. The web app can be accessed on localhost only. No remote access is possible. A security tool discovered an XSS issue. Now if this web app is works only localhost, then how can one exploit this XSS issue ? My guess is that only a local user can exploit this issue.
Yes, it's an issue.
The entire point of an XSS is to send a user to a crafted URL that exploits the bug on that user's browser. If an attacker knows an XSS exists, he could craft an XSS URL and send it to a target user, and that user would be able to access the localhost domain.
For example, say there's a page called
/viewitem which takes a parameter
name, which is vulnerable to XSS:
He sends you that link. You click it, and suddenly you're greeted by an alert box containing the cookies for the page. In reality, he'd post the cookie value off to a 3rd party site, and he's stolen your cookies! In this case he can't actually access the site, so it's a moot point.
However, depending on the configuration of the site, he may be able to exfiltrate data from the
viewitem page too. For example:
If you've got an element with the id
version, the above URL would extract its contents and send it to a 3rd party page, thus informing the attacker of the version of your software. This trick could be extended to steal other private information on the page, or use Ajax to fetch other content from the
It is an issue and here is an attack scenario:
- Vulnerable webapp
Vuln_appis accessible only from
- A user browsing the web from
Attack_sitecontains a webpage with an iframe that points to the
Yes. If you are the only person going to use this application then also you need to bother about XSS because of reflective xss. But if this application is going to be used by co-workers this will be a serious issue. Especially if you are a part of an organization and there are peoples who can access your application, then they can make use of this vulnerability to deface your server and spoil your web application. If your application is hosting for long run this issue should be fixed.