Let's say someone rooted a site, is it possible for the attacker to do XSS via document.cookie? Instead of giving the user a name=value, the attacker does something like this name=<script>document.alert(1)</script> and it will store this in users browser as a cookie when he visits site it will execute. Is this possible or am I just way off? So is it possible to store some kind of VBScript/JavaScript exploit in users cookie? Or is that totally not possible? I know there are different ways attacker can approach if he rooted the site but I'm wondering specifically about cookies in users browsers and their capabilities storing code and attacking the client. Is this a possibility or a myth?


As you point out, if an attacker has rooted the site, you've already lost. There's a number of things they can do that are far more dangerous to your users than cookie-based XSS.

However, it's possible to set cookies for a domain without rooting the site. (Such as injecting them if a user is visiting an HTTP page on the same domain, even if that page doesn't contain anything significant or sensitive.) So let's look at what a cookie can do.

If you output the value of a cookie without escaping it, then there's a definite opportunity for XSS. If you build a tag (such as a link) with the value of the cookie, you might have an XSS. Basically, you should be treating cookies as untrusted input anyway, so you shouldn't have an XSS, but it does happen.

Here are a couple of real-world examples:

| improve this answer | |
  • So it's possible, ie: Using tamper data to edit the cookie set by the website and input javascript code at the end of the cookie value or perhaps replacing the value, essentially , performing a XSS attack. Is that possible? There has to be some kind of input sanitization on the server side right? If not it would be possible to perform XSS, example I stated above, right? – eof0100 Jun 11 '14 at 19:06
  • Merely inserting a script into the cookie is not enough. The cookie has to be used in an unsafe manner, whether output by the server side, or read by the javascript and used to construct DOM elements. (DOM-based XSS.) But yes, what you describe is possible under the right conditions. – David Jun 11 '14 at 19:39
  • Thanks David, answered my question. I mean if I just insert javascript code into a cookie it won't do anything by itself. – eof0100 Jun 11 '14 at 20:53
  • That's correct, it's all about the context where the cookie is used, and if used correctly, there's no problem. – David Jun 11 '14 at 20:53

A prerequisites to such attack would be that the vulnerable web application presents the unscaped document.cookie on a page, and you have to be able to set the clients cookie (XSS vulnerability).

With a combination of these two vulnerabilities, you should be able to enable a persistent XSS attack - given that the server does not resets the cookie.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.