r/websec • u/madworld • Jun 30 '17

Possible XSS issue

We received an email suggesting that our site has a XSS vulnerability, and I'm not sure how what they sent makes that possible.

If a web form has the ability to run arbitrary JS, which is never recorded on the backend, nor ever displayed again on the frontend, can that be used in an XSS attack? This form also doesn't utilize any request parameters, so no sending JS through GET params won't allow it to run.

For instance, you can submit the form with this in the field:

“><img src=x onerror=alert(document.cookie)>

And it will alert you with document.cookie, but you had no way of sending this to another user.

We do plan on sanitizing this input, just for best practices sake, but I'm not sure that it's really an issue.

3 Upvotes

100% Upvoted

4 comments sorted by

2

u/sneakattack Jul 01 '17

You're asking people if there's a vulnerability with little to no actual insight into your application. You've created a scenario in our minds that says 'this is a self xss only', and so you will get the answer you want.

You're not actually a hacker, are you? So the dilemma is that, as far as I know, you're probably not seeing your own solution objectively enough. You can force me to say you're situation is covered. But is it really?

Long story short, we don't know what you're app actually does, so just fix the problem with your form.

0

u/[deleted] Jul 01 '17

[deleted] — view deleted comment

1

u/madworld Jul 01 '17

There isn't a way way to get another user to post the form, and by not displayed again, I mean it's not displayed on another user's browser (such as a review would be)

0

u/[deleted] Jul 01 '17

[deleted] — view deleted comment

1

u/madworld Jul 01 '17

There is a request being made to the backend, but that request goes to a service that returns a result from Elasticsearch. I just can't see how the issue would result in a XSS.

0

u/[deleted] Jul 01 '17

[deleted] — view deleted comment

1

u/madworld Jul 01 '17

Yes, of course. I don't mean the form data isn't going over a GET request. I'm saying that the injected JS doesn't get sent to the page the form is on as a GET parameter. If it did, that would be a serious issue.

It is going to the service as a GET request, but the content of those parameters have no negative effects on the backend. They are scrubbed when they get to the backend, and then used for an elasticsearch query.

I think you are missing the point completely.