8

What I understand about reflected XSS is

... When a web application is vulnerable to this type of attack, it will pass unvalidated input sent through requests back to the client... [1]

Assuming that my webapp has a CSRF validation on server that checks for a valid CSRF token for all requests. It will give proper error if it receives any request not containing CSRF token (this error is a simple string, it has no attack vectors). For the sake of completeness, let's also say that I have proper security measures for preventing CSRF token from being stolen or guessed.

So is it safe to assume that CSRF tokens also prevent reflected XSS attack because both of these are true:

  1. The server doesn't reflect anything if CSRF token is not present.
  2. The attacker cannot have or guess CSRF token.
|improve this question
  • Using CSRF tokens to prevent XSS attacks seems to be fixing the problem by accident. – Matthew Aug 27 '14 at 13:40
10

The answer is usually yes if the value is only reflected if a valid CSRF token is provided - the user can only "attack" themselves in this instance.

However, if there is a form generated that correctly encodes output to a page that contains a CSRF token but then that form submits to a page that does not correctly encode output then your site is still vulnerable.

e.g. Original page (a GET request, which is not normally subject to CSRF tokens due to lack of side effects - only POSTs should cause side effects):-

www.example.com/displayForm.php?name=<script>alert('xss')</script>

contains

<input type="hidden" name="csrfToken" value"123456" />
<input type="hidden" name="name" value="&lt;script&gt;alert(&#039;xss&#039;)&lt;/script&gt;" />

However, when this page is submitted by POST, name is output unencoded:

<body>

Hello <script>alert('xss')</script>.

</body>
|improve this answer
  • 1
    True. But if that the server checks for valid CSRF token for every request (including the one where form.action points) it shouldn't be a problem, right? – mg007 Aug 27 '14 at 10:36
  • @mg007: Right. If in my above example the initial GET request required a token, then this attack would not be possible. However, CSRF tokens are usually only implemented for actions that have side-effects. – SilverlightFox Aug 27 '14 at 10:39
  • BTW "including the one where form.action points" was supposed to be "including request for original page" :) – mg007 Aug 27 '14 at 10:52
  • @mg007: I got that. ;-) – SilverlightFox Aug 27 '14 at 10:53
1

Error pages can have reflected XSS vulnerabilities too, especially when any error trace includes input parameters. If a vulnerable error page is served when the CSRF token is not present, then your CSRF protection does not prevent reflected XSS.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.