Cross-Site Scripting (XSS)

ALTERNATIVE NAMES

Cross-Site Scripting, XSS, client-side code injection.

SEVERITY

HIGH

AFFECTED SYSTEMS

Misconfigured Web applications causing a client-side attack on Victim Browsers

BACKGROUND

On the server-side scripting, if necessary actions to block client-side script injection are not taken care of, there is a potential risk for injecting or altering the client-side scripts. If the system is vulnerable to XSS attacks, the injected code will be rendered and executed by the browser. The attacker can reach all global variables such as session variables and authentication cookies, may redirect to another link or may change the values that are actively present on the browser. Since the XSS attacks targeting web applications, necessary actions to limit the script origin, hashing cookies and checking cookie origin or using URL decoders must be handled by the developers.

DESCRIPTION

Using Cross-Site Scripting (XSS) vulnerability, an attacker may hijack session cookies and other global variables from end-user browser sessions by inserting or altering the client-side codes which are mostly using JavaScript. Even the vulnerability is happening on the client-side, this vulnerability is referred to as server-side incident. Taking necessary actions on the server-side would block Client-Side Scripting vulnerability.

SOLUTION

Never trust returning variables from user input, any variable can be altered on the client-side by the end-user or from the hijacked session. Calculations, necessary controls should be made after getting the user input.
Hash session cookies and other session variables with a hash, decode variables and make necessary controls on the session variables. Browser IP address and a blowfish secret might be combined on client-side cookies.
Never directly return variables from user input to the system, use routing functions to merge redirections.
Use XSS protection offered by your scripting language.
Prevent execution of JavaScript by escaping user input with HTML entities should convert all user input to data instead of arbitrary commands. As an example instead of using “<” you must encode it as %lt; or <

LEGAL

Permission is granted for the redistribution of this alert by explicitly linking the page to be referred. It may not be edited in any way without written consent.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties concerning this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from the use of, or reliance on, this information.