Is cross site scripting possible with the img alt attribute?

Question

If any characters are allowed in the alt attribute of an img tag (except for double quotes), is XSS possible? Valid image or not.

Answer 1

Assuming you are surrounding with double quotes, this would be fine. However, you might want to also escape <>, even though mainstream browsers won't have a problem with it, just in case someone has a broken user agent. It's valid within an attribute, not not required in a double quoted attribute: http://www.w3.org/html/wg/drafts/html/master/syntax.html#attributes-0

Answer 2

You haven't mentioned how the attribute is quoted, so I've covered all possibilities of attribute quoting. This answer reflects the precondition that double quotes are already stripped as you mentioned in your question.

Yes, if the attribute itself is single quoted or unquoted:

<img src='http://www.example.com/foo.jpg' alt='user-controlled' />

and

<img src=http://www.example.com/foo.jpg alt=user-controlled />

are both vulnerable. The first is vulnerable to the following sequence

' onload='alert('xss')

so the tag becomes

<img src='http://www.example.com/foo.jpg' alt='' onload='alert(&apos;xss&apos;)' />

and the second is vulnerable to this sequence

bar onload=alert('xss')

which will be rendered as

<img src=http://www.example.com/foo.jpg alt=bar onload=alert('xss') />

Regarding the attribute being double quoted, as well as restricting or encoding double quote characters (" --> "), you will need to remove or encode the ampersand character (& --> &). From the HTML spec:

Attribute values are a mixture of text and character references, except with the additional restriction that the text cannot contain an ambiguous ampersand

An ambiguous ampersand is a U+0026 AMPERSAND character (&) that is followed by one or more alphanumeric ASCII characters, followed by a ";" (U+003B) character, where these characters do not match any of the names given in the named character references section.

As you cannot guarantee that user controlled data will not contain an "ambiguous ampersand", you should either remove or properly encode this characters.

Now whether an XSS attack is possible with access to only the & character to escape the attribute value, the answer is probably not.

If the value & is entered as your user data, and the tag becomes

<img alt="&" src="http://www.example.com/foo.jpg" />

and the &" will probably be interpreted as &" by most browsers, so using this as an attack vector is unlikely.

However, it is best to do things properly when it comes to security, you never know if this escaping faux pas could be turned into something else evil by something such as mXSS.