XSS in HTML meta tag

Question

There is a web application which contains a search function. When I search for aaaaaaaaxss I get this:

<meta property="the:property" content="100 Results for aaaaaaaaxss (Page 1)" />

It strips the < and > characters but not double quotes. However, since I cannot get rid of the other input, I cannot use 1;javascript:alert(1) or something similar.

Is this filter secure?

Answer 1

I definitely agree with thexacre about the ineffectiveness of blacklisting -- and not just because the answer referenced my website :).

Not being able to get rid of the beginning content portion can certainly limit the opportunity for successful XSS via a meta tag, though it's not entirely impossible. For example, if the beginning portion ever changes to begin with a non-numeric word such as "No results for..." you might be able to inject something like:

;url=hxxp://www.maliciousxss.com" HTTP-EQUIV="refresh" blah=" which, based on your description should result in a meta tag similar to:

<meta property="the:property" content="No results for;url=hxxp://www.maliciousxss.com" HTTP-EQUIV="refresh" blah=" (Page 1)" />

I successfully tested it in FF 29.0.1 but I don't believe this would work in any other modern browser.

If the beginning text always starts with a number you could try something like

" STYLE="width:expression(alert('XSS'));" blah="which again based on your example should result in a meta tag similar to:

<meta property="the:property" content="100 results for" STYLE="width:expression(alert('XSS'));" blah=" (Page 1)" />

This one would only work in IE 7 or earlier so it's even more limited.

I had to make some assumptions of site behavior and additional input validation so these particular examples may not work, but I hope I've helped support thexacre's statement that blacklisting is rarely a completely effective approach. Whitelisting (when possible) is better but output encoding is always a must whenever user-generated data is incorporated in the server response.

Answer 2

Off the top of my head and without seeing the page specifically I can't think of an attack vector, but "blacklisting" is rarely an completely effective security technique so I'd bet it isn't safe.

I found this article for example which specifically addresses meta tags: http://www.securitysift.com/quotes-and-xss-planning-your-escape/

As described in that article, you could inject a HTTP-EQUIV="refresh" and a base64 encoded URL to redirect the page.