usd HeroLab Top 5 Vulnerabilities 2020: Cross-Site Scripting (XSS)

23. April 2021

During penetration tests our security analysts repeatedly uncover gateways in IT systems and applications that pose significant risks to corporate security. They increasingly identify the same vulnerabilities in different IT assets, some of which have been known for years. In our mini-series, we present our top 5 most notable vulnerabilities from 2020. Part 1: Cross-site scripting

Vulnerability Background

Cross-site scripting refers to a category of vulnerabilities that allow an attacker to inject malicious JavaScript code into a web server‘s responses. The web browser of other users then cannot distinguish the JavaScript code inserted by the attacker from the legitimate code of the application and executes malicious scripts accordingly. This usually leads to the attacker being able to completely take over the victim‘s current session.

Exemplary hacker attack and its consequences

The HTTP request below shows how an attacker embeds malicious JavaScript code within an application. Now, when a victim visits the corresponding endpoint within the application, the JavaScript code is executed in his browser context. The JavaScript used in this example extracts the victim’s credentials, which were stored within the browser:

Figure 1: Attacker places malicious JavaScript code inside a vulnerable application

Figure 2: A user visits the vulnerable page – their credentials are extracted

 

While the victim‘s credentials were displayed here for better visibility, a real attack would take place without any traces visible to the victim. Instead of being displayed on screen, the accessed data would have been sent over the network to a server controlled by the attacker.

 

Recommended measures

User-controlled input should always be considered potentially dangerous and should never be embedded within server responses without sufficient filtering and encoding. Appropriate functions for filtering and encoding input are available in all common programming languages. The correct use of frameworks and regular training of developers are important measures to prevent cross-site scripting vulnerabilities.

Please note that this is a very general recommendation for security measures. We are happy to support you with individual solutions. Feel free to contact us.

Read more about our top 5  most notable vulnerabilities and other exciting topics in our 2020 Annual Report.

Also interesting:

usd AG Partner to PCI SSC GEAR 2022-2024

usd AG Partner to PCI SSC GEAR 2022-2024

The PCI Security Standards Council (PCI SSC) has reappointed usd AG to the Global Executive Assessor Roundtable (GEAR). Since 2018, the GEAR has enabled a direct exchange between PCI assessors and the PCI Security Standards Council (PCI SSC). Every two years, leading...

Security Advisory for CleverReach

Security Advisory for CleverReach

The analysts at usd HeroLab examined CleverReach as part of their security analyses. This revealed a vulnerability in the  Authentication Bypass Using an Alternate Path or Channel, which was reported to the manufacturer as part of the Responsible Disclosure...

Security Advisories for CA Harvest

Security Advisories for CA Harvest

The analysts at usd HeroLab examined the CA Harvest Software Change Manager as part of their security analyses. This revealed a vulnerability in the CSV export functionality, which was reported to the manufacturer as part of the Responsible Disclosure Policy. The...

Categories

Categories