Skip to main content

Server side cross-site scripting

Need​

Prevention of server-side cross-site scripting attacks

Context​

  • Usage of Java for building cross-platform applications
  • Usage of javax.servlet for Java web application development
  • Usage of javax.servlet.http for handling HTTP requests and responses in Java web applications

Description​

Non compliant code​

import javax.servlet.*;
import javax.servlet.http.*;

public class VulnerableServlet extends HttpServlet {

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String userField = request.getParameter("userField");
        response.setContentType("text/html");
        PrintWriter out = response.getWriter();
        out.println("<html><body>");
        out.println("<h1>" + userField + "</h1>"); // Vulnerable Point
        out.println("</body></html>");
    }
}

In the code above, we have a simple Java servlet that handles a POST request. The servlet retrieves a parameter from the request, userField, and directly includes it into the HTML response sent back to the client.

The vulnerability lies in the line out.println("<h1>" + userField + "</h1>");. Here, the server is directly embedding the user input (userField) into the HTML response without any form of sanitization or encoding. This means that if a user enters a string that contains JavaScript code, the server will include this code into the HTML response and send it back to the client. When this response is rendered by the client's browser, the JavaScript code will be executed.

This is a classic example of a Server-side Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript code, which could lead to various harmful actions such as stealing sensitive information, performing actions on behalf of the server, or even scanning internal ports.

Steps​

  • Sanitize user input: Before using any user input in the response, make sure to sanitize it to remove any potentially malicious code.
  • Use output encoding: When displaying user input in the response, use output encoding to ensure that any special characters are properly escaped.
  • Implement Content Security Policy (CSP): CSP allows you to define a whitelist of trusted sources for content, preventing the execution of any injected scripts.
  • Enable XSS protection mechanisms: Enable built-in XSS protection mechanisms provided by the framework or web server to automatically detect and block potential XSS attacks.
  • Regularly update and patch dependencies: Keep all libraries and frameworks up to date to ensure that any known vulnerabilities are patched.
  • Perform security testing: Regularly conduct security testing, such as penetration testing and code reviews, to identify and fix any potential vulnerabilities.

Compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import org.owasp.encoder.Encode;

public class SecureServlet extends HttpServlet {

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String userField = request.getParameter("userField");
        response.setContentType("text/html");
        PrintWriter out = response.getWriter();
        out.println("<html><body>");
        out.println("<h1>" + Encode.forHtml(userField) + "</h1>"); // Fixed Point
        out.println("</body></html>");
    }
}

The above code fixes the Server Side Cross-Site Scripting (XSS) vulnerability by sanitizing the user input before using it in the response.

The user input is retrieved from the request parameter "userField". Previously, this input was directly used in the response, which could lead to the execution of malicious scripts if the input contained any.

To fix this, the OWASP Java Encoder library is used to sanitize the user input. The Encode.forHtml(userField) method is used to encode the user input for use in HTML. This method ensures that any special characters in the user input are properly escaped, preventing them from being interpreted as part of a script.

This fix also implies the use of output encoding, which is a recommended practice for preventing XSS attacks. Output encoding ensures that any special characters in the user input are properly escaped, preventing them from being interpreted as part of a script.

In addition to this code fix, it is recommended to implement a Content Security Policy (CSP) to define a whitelist of trusted sources for content, enable built-in XSS protection mechanisms provided by the framework or web server, regularly update and patch dependencies, and perform regular security testing.

References​

Last updated on