I use a site on a regular basis so I wanted to make sure it was secure. One of the things I checked was that when I changed my first name to <img src="http://blah.blah/blah/blah.notanextension" onerror=alert(document.cookie);>Henry that it didn't give me the alert with all of my cookies (I had already determined that they stripped <script> tags). Well it did, however, after going to the home page and then re-visiting my profile, the XSS had been removed from my name. I verified that the filter that did this is applied recursively and works pretty well as far as I could tell. The site uses CSRF tokens, so someone could not insert XSS via CSRF. Is this a security problem even though the input is sanitized whenever I re-visit the page?
-
In the future I am sure site admins would appreciate you not trying to attack their site to test its security. Be aware the things like SQL injection gone wrong could seriously damage the site's database structure.– jamespickFeb 14, 2014 at 21:54
-
1@InsertNameHere, I have to completely disagree with your comment. As an admin on multiple sites, I would more than welcome volunteer security audits, as long as they followed responsible disclosure. Sites such as facebook and Google will often award monetary bounties to individuals who do so responsibly. Such practice improves the security for all the users on the web as a whole.– IndyFeb 15, 2014 at 9:25
-
What makes your think that it is vulnerable at all?– SilverlightFoxFeb 15, 2014 at 12:32
-
The XSS in my name is not removed until I visit the home page and then return. When I added the javascript alert, it displayed the popup each time I refreshed the page until I went to the home page and back again.– 735TeslaFeb 15, 2014 at 12:35
-
@Indy While many admins will welcome security checks, it's still a risk, since there are some who are willing to sue such "evil hackers".– CodesInChaosFeb 17, 2014 at 12:09
Add a comment
|
2 Answers
Yes it could be a problem. It depends on the point that the first name field is sanitized. My first impressions that it was a DOM update that caused the alert to be shown (see DOM based XSS). However, as you said you could refresh the page this is unlikely unless a hash is added to the address bar (e.g. www.example.com/page.aspx#name=foo).
Maybe a script runs to sanitize the value when the home page is displayed (which would be odd). There is also the possibility that certain values can bypass the sanitization and exploit the vulnerability. Either of these things mean that the XSS payload may be executed when an admin user views the list of users.
There is also the possibility that Broken Access Controls could allow another user to update the first name of another user to exploit this XSS flaw when they log in.
It all depends on when the sanitisation executes, so more investigation would be needed on the site to determine this.
answered Feb 17, 2014 at 11:31
So from what you're saying it sounds like the update isn't persisted to the database, it shows on the page when you save it, but not if you navigate away and then back.
If that's the case then this is likely to be a limited risk (not to say I wouldn't recommend fixing it though), as it would be hard to construct a valid attack scenario where this could have an impact.
In order for an attacker to exploit it, it sounds like they'd need access to your session to enter the data, at which point stealing your session token is a bit pointless.
As it doesn't persist then there's no risk of another user viewing your name and executing the JavaScript.
If the data you've entered shows up elsewhere in the application (for example in an administration page), then obviously then it would be a nasty 2nd order XSS which could have quite a large impact.
answered Feb 17, 2014 at 11:59
