Re: Can you exploit this XSS?

From: Paul Johnston (paul_at_westpoint.ltd.uk)
Date: 11/19/03

  • Next message: Scovetta, Michael V: "RE: Can you exploit this XSS?" 
    Date: Wed, 19 Nov 2003 17:10:56 +0000
To: "Scovetta, Michael V" <Michael.Scovetta@ca.com>

    Hi Michael,

    What you describe is "persistent XSS" and the worst kind. But the lesser
    kind, like I described, is still a vulnerability. If you can persuade a
    user to click a malicious link, the malicious javascript will run in
    their browser with the priviliges of the vulnerable site. Getting
    someone to click a link is relatively easy, especially as they may not
    have to literally click it, because of iframe, redirects, etc.

    Paul

    Scovetta, Michael V wrote:

    >As I understand XSS, it is only exploitable when user A enters data that
    >user B views. XSS is moot when you can only do it to yourself, so screens
    >like that (a redirect), is just a convenience for the user. It should
    >still be properly clensed, but I don't see this being a true case of XSS,
    >more like JavaScript Injection.
    >
    >Michael Scovetta
    >Application Developer
    >Computer Associates International, Inc.
    >
    >
    >-----Original Message-----
    >From: Paul Johnston [mailto:paul@westpoint.ltd.uk]
    >Sent: Wednesday, November 19, 2003 7:51 AM
    >To: vuln-dev@securityfocus.com; rich@westpoint.ltd.uk
    >Subject: Can you exploit this XSS?
    >
    >
    >Hi,
    >
    >While auditing a web app, I've found the site redirects not found pages
    >to a login screen. This contains an element like:
    >
    ><input type="hidden" name="tageturl" value="XXX">
    >
    >Now, the XXX bit is controlled by the user, and it seems the only
    >characters escaped are " and & - i.e.
    ><script>alert(document.cookie)</script> gets through (hence my tool
    >alerted me).
    >
    >Can this be exploited for XSS? I can't see how to immediately, but it
    >seems possible.
    >
    >Paul
    >
    >
    > 

    -- 
Paul Johnston
Internet Security Specialist
Westpoint Limited
Albion Wharf, 19 Albion Street,
Manchester, M1 5LN
England
Tel: +44 (0)161 237 1028
Fax: +44 (0)161 237 1031
email: paul@westpoint.ltd.uk
web: www.westpoint.ltd.uk
  • Next message: Scovetta, Michael V: "RE: Can you exploit this XSS?"

    Relevant Pages

    • Re: [Full-disclosure] on xss and its technical merit
      ... detailed technical knowledge of all things xss. ... other's attacks since then. ... "Saying XSS isn't a vulnerability is like like saying a binary that ... (javascript is ONE scripting language and therefore NOT a requirement)). ...
      (Full-Disclosure)
    • Re: [Full-disclosure] on xss and its technical merit
      ... "Saying XSS isn't a vulnerability is like like saying a binary that has a ... "XSS needs javascript, binary needs its own malcode as well." ... (javascript is ONE scripting language and therefore NOT a requirement)). ...
      (Full-Disclosure)
    • [Full-disclosure] dt_guestbook version 1.0f XSS vulnerability
      ... fully-featured message board system with admin interface. ... flaws it is possible for the remote attacker to conduct XSS attacks. ... This vulnerability can be exploited only when PHP register_globals is ... Vulnerability Impact: Attack ...
      (Full-Disclosure)
    • [VulnWatch] Re: New Web Vulnerability - Cross-Site Tracing
      ... then it could pose a significant threat. ... >and the involvement of three parties in XSS (attacker, victim, ... As specific issues in widely-deployed pieces of software become less common, attacks against application components will become more common. ... >But that should only affect how XSS is prioritized as a vulnerability ...
      (VulnWatch)
    • [Full-Disclosure] Re: New Web Vulnerability - Cross-Site Tracing
      ... then it could pose a significant threat. ... >and the involvement of three parties in XSS (attacker, victim, ... As specific issues in widely-deployed pieces of software become less common, attacks against application components will become more common. ... >But that should only affect how XSS is prioritized as a vulnerability ...
      (Full-Disclosure)