Cross-site scripting

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side script into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy. Cross-site scripting carried out on websites accounted for roughly 84% of all security vulnerabilities documented by Symantec as of 2007.[1] Their effect may range from a petty nuisance to a significant security risk, depending on the sensitivity of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner.

Contents

  • Background 1
  • Types 2
    • Reflected (non-persistent) 2.1
    • Persistent 2.2
    • Server-side versus DOM-based vulnerabilities 2.3
  • Exploit examples 3
    • Non-persistent 3.1
    • Persistent attack 3.2
  • Preventative measures 4
    • Contextual output encoding/escaping of string input 4.1
    • Safely validating untrusted HTML input 4.2
    • Cookie security 4.3
    • Disabling scripts 4.4
    • Emerging defensive technologies 4.5
  • Scanning service 5
  • Related vulnerabilities 6
  • See also 7
  • References 8
  • Further reading 9
  • External links 10

Background

Security on the web is based on a variety of mechanisms, including an underlying concept of trust known as the same-origin policy. This essentially states that if content from one site (such as https://mybank.example1.com) is granted permission to access resources on the system, then any content from that site will share these permissions, while content from another site (https://othersite.example2.com) will have to be granted permissions separately.[2]

Cross-site scripting attacks use known vulnerabilities in web-based applications, their servers, or plug-in systems on which they rely. Exploiting one of these, attackers fold malicious content into the content being delivered from the compromised site. When the resulting combined content arrives at the client-side web browser, it has all been delivered from the trusted source, and thus operates under the permissions granted to that system. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user. Cross-site scripting attacks are therefore a special case of code injection.

The term "cross-site scripting" was introduced by Microsoft in the year 2000.[3] The expression "cross-site scripting" originally referred to the act of loading the attacked, third-party web application from an unrelated attack site, in a manner that executes a fragment of JavaScript prepared by the attacker in the security context of the targeted domain (taking advantage of a reflected or non-persistent XSS vulnerability). The definition gradually expanded to encompass other modes of code injection, including persistent and non-JavaScript vectors (including ActiveX, Java, VBScript, Flash, or even HTML scripts), causing some confusion to newcomers to the field of information security.[4]

XSS vulnerabilities have been reported and exploited since the 1990s. Prominent sites affected in the past include the social-networking sites Twitter,[5] Facebook,[6] MySpace, YouTube and Orkut.[7][8] In recent years, cross-site scripting flaws surpassed buffer overflows to become the most common publicly reported security vulnerability,[9] with some researchers in 2007 viewing as many as 68% of websites as likely open to XSS attacks.[10]

Types

There is no single, standardized classification of cross-site scripting flaws, but most experts distinguish between at least two primary flavors of XSS flaws: non-persistent and persistent. Some sources further divide these two groups into traditional (caused by server-side code flaws) and DOM-based (in client-side code).

Reflected (non-persistent)

Example of a non-persistent XSS flaw

Non-persistent XSS vulnerabilities in Google could allow malicious sites to attack Google users who visit them while logged in.[11]

The non-persistent (or reflected) cross-site scripting vulnerability is by far the most common type.[12] These holes show up when the data provided by a web client, most commonly in HTTP query parameters or in HTML form submissions, is used immediately by server-side scripts to parse and display a page of results for and to that user, without properly sanitizing the request.[13]

Because HTML documents have a flat, serial structure that mixes control statements, formatting, and the actual content, any non-validated user-supplied data included in the resulting page without proper HTML encoding, may lead to markup injection.[12][13] A classic example of a potential vector is a site search engine: if one searches for a string, the search string will typically be redisplayed verbatim on the result page to indicate what was searched for. If this response does not properly escape or reject HTML control characters, a cross-site scripting flaw will ensue.[14]

A reflected attack is typically delivered via email or a neutral web site. The bait is an innocent-looking URL, pointing to a trusted site but containing the XSS vector. If the trusted site is vulnerable to the vector, clicking the link can cause the victim's browser to execute the injected script.

Persistent

Example of a persistent XSS flaw

A persistent cross-zone scripting vulnerability coupled with a computer worm allowed execution of arbitrary code and listing of filesystem contents via a QuickTime movie on MySpace.[15]

The persistent (or stored) XSS vulnerability is a more devastating variant of a cross-site scripting flaw: it occurs when the data provided by the attacker is saved by the server, and then permanently displayed on "normal" pages returned to other users in the course of regular browsing, without proper HTML escaping. A classic example of this is with online message boards where users are allowed to post HTML formatted messages for other users to read.[13]

For example, suppose there is a dating website where members scan the profiles of other members to see if they look interesting. For privacy reasons, this site hides everybody's real name and email. These are kept secret on the server. The only time a member's real name and email are in the browser is when the member is signed in, and they can't see anyone else's.

Suppose that Mallory, an attacker, joins the site and wants to figure out the real names of the people she sees on the site. To do so, she writes a script designed to run from other people's browsers when they visit her profile. The script then sends a quick message to her own server, which collects this information.

To do this, for the question "Describe your Ideal First Date", Mallory gives a short answer (to appear normal) but the text at the end of her answer is her script to steal names and emails. If the script is enclosed inside a ",

  • An alert box appears (that says "xss").
  • The page displays " not found", along with an error message with the text 'xss'.
  • The url is "http://bobssite.org?q=alert('xss'); - which is exploitable behavior.
  • Mallory crafts a URL to exploit the vulnerability.
  • He makes the URL http://bobssite.org?q=puppies. He could choose to convert the [22]
  • He sends an e-mail to some unsuspecting members of Bob's site, saying "Check out some cute puppies!"
  • Alice gets the e-mail. She loves puppies and clicks on the link. It goes to Bob's website to search, doesn't find anything, and displays "puppies not found" but right in the middle, the script tag runs (it is invisible on the screen) and loads and runs Mallory's program authstealer.js (triggering the XSS attack). Alice forgets about it.
  • The authstealer.js program runs in Alice's browser, as if it originated from Bob's website. It grabs a copy of Alice's Authorization Cookie and sends it to Mallory's server, where Mallory retrieves it.
  • Mallory now puts Alice's Authorization Cookie into his browser as if it were his own. He then goes to Bob's site and is now logged in as Alice.
  • Now that he's in, Mallory goes to the Billing section of the website and looks up Alice's credit card number and grabs a copy. Then he goes and changes her password so Alice can't even log in anymore.
  • He decides to take it a step further and sends a similarly crafted link to Bob himself, thus gaining administrator privileges to Bob's website.
  • Several things could have been done to mitigate this attack:

    1. The search input could have been sanitized which would include proper encoding checking.
    2. The web server could be set to redirect invalid requests.
    3. The web server could detect a simultaneous login and invalidate the sessions.
    4. The web server could detect a simultaneous login from two different IP addresses and invalidate the sessions.
    5. The website could display only the last few digits of a previously used credit card.
    6. The website could require users to enter their passwords again before changing their registration information.
    7. The website could enact various aspects of the Content Security Policy.
    8. Most importantly, users could be educated to not click "benign-looking," but malicious, links.

    Persistent attack

    1. Mallory gets an account on Bob's website.
    2. Mallory observes that Bob's website contains a stored XSS vulnerability. If you go to the News section, and post a comment, it will display whatever he types in for the comment. But, if the comment text contains HTML tags in it, the tags get displayed as is, and any script tags get run.
    3. Mallory reads an article in the News section and writes in a comment at the bottom in the Comments section. In the comment, he inserts this text: I love the puppies in this story! They're so cute!