Reflected Cross-Site Scripting (Reflected XSS)

Reflected Cross-Site Scripting (Reflected XSS) is a type of security vulnerability that occurs when an application includes data controlled by an attacker in an HTTP response without appropriate context-aware output encoding. In this scenario, the malicious script is sent to the server as part of a request, then reflected back to the victim's browser, where it is executed within the context of a trusted website.

How Reflected XSS Works

1. Identify a Vulnerable Input: The attacker finds an input parameter in the application that is reflected in the server's response.
2. Craft a Malicious Request: The attacker embeds malicious JavaScript in a URL, form submission, or other types of requests.
3. Victim Interaction: The victim clicks the harmful link or submits the crafted request.
4. Server Reflection: The application reflects the attacker-controlled input in the HTTP response without proper output encoding.
5. Script Execution: The victim's browser executes the injected JavaScript.

Reflected XSS Impact

• Session Hijacking: Attackers can steal session information or authentication tokens from victims, allowing access to user accounts.
• Sensitive Data Theft: Attackers may access information available within the victim's browser session or extract data shown by the vulnerable application.
• Account Compromise: Attackers can perform unauthorized actions on behalf of the victim, such as changing account settings or accessing protected resources.
• Phishing and Social Engineering: Attackers can inject fake login forms, misleading messages, or malicious content to trick users into revealing their credentials.
• Unauthorized Actions: Attackers can execute requests with the victim's existing permissions to perform actions the user is authorized to undertake.

Reflected XSS Mitigation

• Perform Context-Aware Output Encoding: Always encode user-supplied data before including it in HTML, JavaScript, CSS, or URL contexts.
• Validate User Input: Ensure user input matches expected formats and lengths. Input validation should complement, not replace, output encoding.
• Implement Content Security Policy (CSP): Use CSP to reduce the impact of any injected scripts.
• Avoid Reflecting Untrusted Input: Refrain from including user-supplied data in responses unless it has been properly encoded.
• Use Secure Framework Features: Utilize templating engines and frameworks that automatically encode output by default.

Reflected XSS Example

Clone this current repo recursively

git clone --recurse-submodules https://github.com/qeeqbox/reflected-cross-site-scripting

Run the webapp using Python

python3 reflected-cross-site-scripting/vulnerable-web-app/webapp.py

Open the webapp in your browser 127.0.0.1:5142

Open the network tab from the developer tools to examine the requests and responses

If you type the URL + test, it will take you to the test resourse (page), it does not exist but the test keyword gets embedded in the page

A threat actor could embed a malicious payload and send it to a victim using social engineering attacks. If the victim falls for it, their browser will send the request to the webapp

Then, the browser will execute a malicious payload

Code

This logic will check if the requested page has a route or exists, if it does not, then it will pass the requested page value to the msg_page() function

def do_GET(self):
    ...
    self.send_content(404, [('Content-type', 'text/html')], self.msg_page(f"Error: The requested URL {urllib_parse.unquote(parsed_url.path)} was not found".encode("utf-8")))
    ...

The msg_page() function will embed the user value in the webpage

def msg_page(self, msg, prev=None):
    with open(path.join(TEMPLATE_FOLDER,"msg.html"),"rb") as fi:
        if prev:
            return fi.read().replace(b"{{msg-result}}",msg).replace(b"{{msg-prev}}",prev).replace(b"{{msg-page}}",b"Return")
        else:
            return fi.read().replace(b"{{msg-result}}",msg).replace(b"{{msg-prev}}",b"/").replace(b"{{msg-page}}",b"Home")