Skip to main content

Insecure service configuration

Need​

Secure service configuration to prevent XSS attacks

Context​

  • Usage of C# for building robust and scalable applications
  • Usage of Microsoft.Extensions.DependencyInjection for dependency injection in .NET applications
  • Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core MVC

Description​

Non compliant code​

public void ConfigureServices(IServiceCollection services)
{
    services.AddControllers()
        .AddMvcOptions(options => { });
}

In the provided code snippet, an ASP.NET Core application is being configured. The ConfigureServices method is used to set up the application's services during startup. Here, we add MVC to the application's services but do not specify any options.

The vulnerability here lies in the fact that we are not setting any requestValidationMode in our server configuration. This could potentially leave our application open to Cross-Site Scripting (XSS) attacks.

In an XSS attack, an attacker injects malicious scripts into content that is sent to a web browser. The browser then executes the script because it believes the script came from a trusted source. The script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.

By not setting a requestValidationMode, we are not instructing our application to validate requests for potentially harmful content, and this could enable an attacker to send such harmful content in a request.

Steps​

  • Set the requestValidationMode to a secure value in the server configuration files.
  • Configure the ASP.NET Core application to use the appropriate request validation mode.
  • Ensure that the requestValidationMode is set to a value that enables XSS protection.
  • Test the application thoroughly to ensure that the XSS vulnerability is mitigated.

Compliant code​

public void ConfigureServices(IServiceCollection services)
{
    services.AddControllers()
        .AddMvcOptions(options => 
        {
            options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute());
        });
}

The above code snippet is a fixed version of the vulnerable code. The vulnerability was due to the lack of request validation mode in the server configuration files, which could potentially allow Cross-Site Scripting (XSS) attacks.

In the fixed code, we have added an AutoValidateAntiforgeryTokenAttribute filter to the MVC options. This filter helps to prevent Cross-Site Request Forgery (CSRF) attacks, which are a type of XSS attack. CSRF attacks occur when a malicious website, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site for which the user is authenticated.

The AutoValidateAntiforgeryTokenAttribute filter works by ensuring that a unique anti-forgery token, associated with the current user's identity, is present on all non-GET requests. This token is used to ensure that the user is the one actually performing the actions on the application, not a malicious script.

After applying this fix, it's important to thoroughly test the application to ensure that the XSS vulnerability is effectively mitigated.

References​

Last updated on