CAPEC-244 - Cross-Site Scripting via Encoded URI Schemes

An attack of this type exploits the ability of most browsers to interpret "data", "javascript" or other URI schemes as client-side executable content placeholders. This attack consists of passing a malicious URI in an anchor tag HREF attribute or any other similar attributes in other HTML tags. Such malicious URI contains, for example, a base64 encoded HTML content with an embedded cross-site scripting payload. The attack is executed when the browser interprets the malicious content i.e., for example, when the victim clicks on the malicious link.

Severity

Likelihood

Confidentiality

Integrity

Availability

  • Attack Methods 2
  • Injection
  • Protocol Manipulation
  • Purposes 1
  • Exploitation
  • Scopes 7
  • Modify files or directories
  • Integrity
  • Read files or directories
  • Confidentiality
  • Modify application data
  • Integrity
  • Read application data
  • Confidentiality
  • Execute unauthorized code or commands
  • Authorization
  • Gain privileges / assume identity
  • Non-Repudiation
  • Authorization
  • Authentication
  • Accountability
  • Bypass protection mechanism
  • Authorization
  • Access_Control

Medium level: To inject the malicious payload in a web page

Target client software must allow scripting such as JavaScript and allows executable content delivered using a data URI scheme.

Ability to send HTTP request to a web application

Step 1 - Survey the application

Using a browser or an automated tool, an attacker follows all public links on a web site. He records all the links he finds..

Tecnique ID: 1 - Environment(s) env-Web

Use a spidering tool to follow and record all links. Make special note of any links that include parameters in the URL.

Tecnique ID: 2 - Environment(s) env-Web

Use a proxy tool to record all links visited during a manual traversal of the web application. Make special note of any links that include parameters in the URL. Manual traversal of this type is frequently necessary to identify forms that are GET method forms rather than POST forms.

Tecnique ID: 3 - Environment(s) env-Web

Use a browser to manually explore the website and analyze how it is constructed. Many browser's plugins are available to facilitate the analysis or automate the URL discovery.

Indicator ID: 1 - Environment(s) env-Web

Type: Positive

URL parameters are used by the application or the browser (DOM) in a context that is originally used for storing URL (anchor's "href", script's "src", etc.)

Indicator ID: 2 - Environment(s) env-Web

Type: Inconclusive

Using URL rewriting, parameters may be part of the URL path.

Indicator ID: 3 - Environment(s) env-Web

Type: Inconclusive

No parameters appear on the URL. Even though none appear, the web application may still use them if they are provided.

Indicator ID: 4 - Environment(s) env-Web

Type: Negative

Applications that have only static pages or that simply present information without accepting input are unlikely to be susceptible.



Step 1 - Attempt injection payload variations on input parameters

Possibly using an automated tool, an attacker requests variations on the inputs he surveyed before. He sends parameters that include variations of payloads. He records all the responses from the server that include unmodified versions of his script..

Tecnique ID: 1 - Environment(s) env-Web

Use a list of XSS probe strings using different URI schemes to inject in parameters of known URLs. If possible, the probe strings contain a unique identifier to trace the injected string back to the entry point.

Tecnique ID: 2 - Environment(s) env-Web

Use a proxy tool to record results of manual input of XSS probes in known URLs.

Indicator ID: 1 - Environment(s) env-Web

Type: Positive

Input parameters are printed back in a URL placeholder that support different URI schemes such as HREF, SRC, and other attributes

Indicator ID: 2 - Environment(s) env-Web

Type: Inconclusive

Nothing is returned to the web page. The payload may be a stored to be served later. The unique identifier from the probe helps to trace the flow of the possible XSS


Security Control ID: 1

Type: Detective

Monitor input to web servers, application servers, and other HTTP infrastructure (e.g., load balancers). Alert on standard XSS probes. The majority of attackers use well-known strings to check for vulnerabilities. Use the same vulnerability catalogs that adversaries use.

Security Control ID: 2

Type: Preventative

Apply appropriate input validation to filter all user-controllable input of scripting syntax

Security Control ID: 3

Type: Preventative

Do not embed user-controllable input generated HTTP headers

Security Control ID: 4

Type: Preventative

Actively monitor the application and either deny or redirect requests from origins that appear to be generating XSS probes.


Outcome ID: 1

Type: Success

The attacker's cross-site scripting string is included in the URI scheme content and can be triggered by a user (a victim in this case).

Outcome ID: 2

Type: Failure

Custom URI scheme aren't allowed by the application

Outcome ID: 3

Type: Inconclusive

Some sensitive characters are consistently encoded, but others are not



Step 1 - Steal session IDs, credentials, page content, etc.

As the attacker succeeds in exploiting the vulnerability, he can choose to steal user's credentials in order to reuse or to analyze them later on..

Tecnique ID: 1 - Environment(s) env-Web

Develop malicious JavaScript that is injected through vectors identified during the Experiment Phase and loaded by the victim's browser and sends document information to the attacker.

Tecnique ID: 2 - Environment(s) env-Web

Develop malicious JavaScript that injected through vectors identified during the Experiment Phase and takes commands from an attacker's server and then causes the browser to execute appropriately.

Security Control ID: 1

Type: Detective

Monitor server logs for scripting parameters.

Security Control ID: 2

Type: Detective

Monitor server logs for referrers. If users are being tricked into clicking XSS links through forums or other web postings, their web browsers will be providing Referrer headers most of the time. These can help indicate that the actual request is illegitimate.

Security Control ID: 3

Type: Preventative

Apply appropriate input validation to filter all user-controllable input of scripting syntax

Security Control ID: 4

Type: Preventative

Appropriately encode all browser output to avoid scripting syntax

Security Control ID: 5

Type: Preventative

Actively monitor the application and either deny or redirect requests from origins that appear to be generating XSS probes.


Outcome ID: 1

Type: Success

The attacker gets the user's cookies or other session identifiers.

Outcome ID: 2

Type: Success

The attacker gets the content of the page the user is viewing.

Outcome ID: 3

Type: Success

The attacker causes the user's browser to visit a page with malicious content.


Step 2 - Forceful browsing

When the attacker targets the current application or another one (through CSRF vulnerabilities), the user will then be the one who perform the attacks without being aware of it. These attacks are mostly targeting application logic flaws, but it can also be used to create a widespread attack against a particular website on the user's current network (Internet or not)..

Tecnique ID: 1 - Environment(s) env-Web

Develop malicious JavaScript that is injected through vectors identified during the Experiment Phase and loaded by the victim's browser and performs actions on the same web site

Tecnique ID: 2 - Environment(s) env-Web

Develop malicious JavaScript that injected through vectors identified during the Experiment Phase and takes commands from an attacker's server and then causes the browser to execute request to other web sites (especially the web applications that have CSRF vulnerabilities).

Security Control ID: 1

Type: Detective

Monitor server logs for scripting parameters.

Security Control ID: 2

Type: Detective

Monitor server logs for referrers. If users are being tricked into clicking XSS links through forums or other web postings, their web browsers will be providing Referrer headers most of the time. These can help indicate that the actual request is illegitimate.

Security Control ID: 3

Type: Preventative

Apply appropriate input validation to filter all user-controllable input of scripting syntax

Security Control ID: 4

Type: Preventative

Appropriately encode all browser output to avoid scripting syntax

Security Control ID: 5

Type: Preventative

Actively monitor the application and either deny or redirect requests from origins that appear to be generating XSS probes.


Outcome ID: 1

Type: Success

The attacker indirectly controls the user's browser and makes it performing actions exploiting CSRF.

Outcome ID: 2

Type: Success

The attacker manipulates the browser through the steps that he designed in his attack. The user, identified on a website, is now performing actions he is not aware of.


Step 3 - Content spoofing

By manipulating the content, the attacker targets the information that the user would like to get from the website.

Tecnique ID: 1 - Environment(s) env-Web

Develop malicious JavaScript that is injected through vectors identified during the Experiment Phase and loaded by the victim's browser and exposes attacker-modified invalid information to the user on the current web page.

Security Control ID: 1

Type: Detective

Monitor server logs for scripting parameters.

Security Control ID: 2

Type: Detective

Monitor server logs for referrers. If users are being tricked into clicking XSS links through forums or other web postings, their web browsers will be providing Referrer headers most of the time. These can help indicate that the actual request is illegitimate.

Security Control ID: 3

Type: Preventative

Apply appropriate input validation to filter all user-controllable input of scripting syntax

Security Control ID: 4

Type: Preventative

Appropriately encode all browser output to avoid scripting syntax

Security Control ID: 5

Type: Preventative

Actively monitor the application and either deny or redirect requests from origins that appear to be generating XSS probes.


Outcome ID: 1

Type: Success

The user sees a page containing wrong information



Design: Use browser technologies that do not allow client side scripting.

Design: Utilize strict type, character, and encoding enforcement.

Implementation: Ensure all content that is delivered to client is sanitized against an acceptable content specification.

Implementation: Ensure all content coming from the client is using the same encoding; if not, the server-side application must canonicalize the data before applying any filtering.

Implementation: Perform input validation for all remote content, including remote and user-generated content

Implementation: Perform output validation for all remote content.

Implementation: Disable scripting languages such as JavaScript in browser

Implementation: Patching software. There are many attack vectors for XSS on the client side and the server side. Many vulnerabilities are fixed in service packs for browser, web servers, and plug in technologies, staying current on patch release that deal with XSS countermeasures mitigates this.