DOM based if you're basing it on the stored/reflected/DOM classification system.
From OWASP Types of Cross-Site Scripting:
DOM Based XSS is a form of XSS where the entire tainted data flow from
source to sink takes place in the browser, i.e., the source of the
data is in the DOM, the sink is also in the DOM, and the data flow
never leaves the browser.
Here the source of the data is
document.cookie and the sink is also in the DOM (HTML content of a paragraph).
However, classifying XSS in such a way really only boils down to semantics, as the article notes:
For years, most people thought of these (Stored, Reflected, DOM) as
three different types of XSS, but in reality, they overlap. You can
have both Stored and Reflected DOM Based XSS.
Using the above I guess you could classify it as "Reflected DOM Based".
OWASP have attempted to try and get people to reclassify XSS as either server based or client based, where DOM XSS is a subset of Client XSS. Using this system it would be a "Reflected Client XSS" vulnerability.
Regardless of actual classification, the vulnerability here is in the DOM rather than the cookie storage as there is no need to HTML encode for storage into a cookie. Encoding should be done as late as possible when the usage context is known otherwise this cookie could have been poisoned.
- Website is on
example.com and it normally only listens on HTTPS.
- Attacker Man-In-The-Middles an HTTP connection from their victim and sends them to
example.com over plain HTTP. The HTTP server in this case is the attacker's.
- Attacker sets the cookie containing some script code.
- The victim later visits the real
example.com over HTTPS and the XSS is triggered.
As the code that adds the text to the DOM is not correctly HTML encoding, this is a DOM based XSS attack. As you can see from the above example, not HTML encoding on storage into the cookie doesn't stop the above attack scenario.