2

I run a vulnerability scanner on my website which showed me a couple of vulnerabilities which look like this:

http://.../search?text=&ClassIDNames[37]=<script>alert('Found')</script>&ActiveFacet[ClassID]=37

but when copying the url to the browser it does not give me the alert output but the search result for the corresponding input. Is this anything I have to fix or is it nothing to worry about? Or do I have to do anything else to reproduce it somehow?

  • Yeah sure, I just didn't wont to post that one here :) – wasp256 Jun 17 '15 at 21:04
  • Find the string in the page's source. What does it look like? You need to figure out if it is being blocked somewhere along the way, or if it is really inject but simply does not work. – AviD Jun 17 '15 at 21:14
  • Ok I looked it up in the souce code now, and it has been injected with the above <script>...</script>, but simply doesn't work!? Is there a way that firefox blocks it as well? – wasp256 Jun 17 '15 at 21:19
6

Some scanners simply search for the injected string ("found" in this case) somewhere on the page, if "found" is in the search results, then it would classify it as a positive finding.

If the XSS string is being interpreted as a string in the search function (literally searching for the string <script>alert('Found')</script>, then you can chalk it up as a false positive - the scanner saw its own injected string in the resulting page.

  • The content of the source is <a href="/search?text="><script>alert('Found')</script> – wasp256 Jun 17 '15 at 21:25
  • The source seems to show the GET variable as-is. For me it's vulnerable. Why do you think that it's a false positive ? – r00t Jun 19 '15 at 16:19
  • Thanks for the answer, considering the fact that this is a search field that simply replies with a list of results, how could it even be exploited with XSS? – wasp256 Jun 22 '15 at 21:39
2

Your source content <a href="/search?text="><script>alert('Found')</script> seems to show that your application is vulnerable to XSS. I think your browser is just mitigating the injection because it detects that it's inline javascript.

Maybe you are using a framework that is sending to your browser some mitigation headers. Look at the OWASP useful HTTP headers and particularly the X-XSS-Protection and Content security policy : https://www.owasp.org/index.php/List_of_useful_HTTP_headers.

As some browser (the old ones) will not honor those headers, I strongly suggest you to sanitize properly every input and not to rely on those mitigation solutions.

You have a really good and complete guide for preventing XSS on https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet

Cheers.

1

Perhaps the the XSS-code ended up inside a tag of which the contents are interpreted as text-only, such as <title> or <textarea>. Try prepending the XSS code with </textarea> or </title> if this is the case.

It may also have ended up in an attribute of an element, in which case you need to close the attribute and element using "> or '>

0

Normally vulnerabilities in the website can be done manually and using scanner tools.First determine the vulnerabilities using the Scanner tools and then check for False Positive, means verifying the scanning results. While verifying manually if the issue is not found then it is False Positived means it will be eliminated. In case like XSS the browser may prevent or filter out the XSS.Try with disabling the XSS filter in the browser.If there is no issues then no need to worry about this vulnerability.

0

Vulnerabilites determined by the scanner is not the accurate one anyway we have to cross check each and every vulnerable paramaters and url which is shown in the scanner.

Scanner may also left some vulnerablities in some cases for that we have to manually check through the website.

While verifying the result of the scanner,by copying the url to the browser,if it does not give the alert then it can be said as a False positive finding. The browsers like Chrome,Firefox,IE can also block the XSS.

Inorder to disable this filter in firefox and IE read this article:https://www.phillips321.co.uk/2012/03/01/xss-browser-filters-disabling-it-for-app-testing/

Inorder to prevent Xss vulnerability use can go through https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet

-1

Are you doing it in Chrome? Chrome has an XSS auditor which can block a lot of XSS attacks. If you are in Chrome, you can open the Developer Tools window and it will show when XSS attacks are blocked.

You may also want to try a different browser like IE.

  • No I am using firefox 38.0 – wasp256 Jun 17 '15 at 21:10
  • IE also has a pretty strong XSS blocker (even though it is possible to bypass, but then same with Chrome...) – AviD Jun 17 '15 at 21:12
  • Welcome to the Security StackExchange, David! Keep in mind it's often better to use the comment system when asking for clarification, rather than posting an answer and running the risk of being off-topic. :-) – Steve Dodier-Lazaro Jun 17 '15 at 23:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.