We have just had some pen testing completed against a web application and the one area identified as High Impact and Medium Probability was:
Cross-Site scripting (reflected)
The example given was the ability to manipulate a URL such as:
www.domain.com/application/index.php/<IFRAME SRC=source.com onload="alert(document.cookie)"></IFRAME>
Any data which is actually passed to the application via forms, GET etc are escaped and if you enter the above iframe code into a form and submit or pass it as a GET parameter it "does nothing" but when I go to this URL in a browser, I get varying results depending on the browser ranging from nothing in Chrome and IE to Firefox showing the cookie in a popup.
HTTP response as requested:
GET /application/index.php/%3CBODY%20ONLOAD=alert%28%27XSS%27%29%3E HTTP/1.1 Host: "www.domain.com":http://www.domain.com Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close
Obviously I cannot rely on the user using the correct browser so how can I mitigate against this as the code is being passed in the actual URL itself and, from what I can see, is executed before the application loads so I cannot see how I can escape it if it runs in the URL or am I wrong?
There is no genuine reason why anyone should be passing ', ", < or > via the URL so are there server level controls which can strip untoward characters out of the URL maybe using regex in htaccess, for example?