Skip to main content

Universal cross-site scripting (UXSS)

Need​

Prevention of universal cross-site scripting attacks

Context​

  • Usage of Ruby 2.7 for developing Ruby applications
  • Usage of Rails framework for building web applications
  • Usage of ActiveRecord for Object-Relational Mapping (ORM) in a Node.js application

Description​

Non compliant code​

class PostsController < ApplicationController
  def show
    @post = Post.find(params[:id])
    @comment = @post.comments.build
    @comment.content = params[:comment_content]
  end
end

This Ruby on Rails controller action is vulnerable to Universal Cross-Site Scripting (UXSS). The show action in the PostsController retrieves a post based on the id parameter. It then builds a new comment for the post and sets the content of the comment to the comment_content parameter.

The vulnerability lies in the fact that the comment_content parameter is directly taken from the request parameters and assigned to the @comment.content without any sort of sanitization or escaping. This means that if a user was able to craft a request with a comment_content parameter containing malicious JavaScript code, this code would be directly injected into the comment's content.

When this comment is rendered in a view, the malicious JavaScript code will be executed in the context of the victim's browser session. This could allow an attacker to steal sensitive information such as session cookies, perform actions on behalf of the victim, or even inject malicious software into the victim's system.

This type of vulnerability is called Universal Cross-Site Scripting (UXSS) because it exploits client-side vulnerabilities in the user's browser or extensions, and it can affect any site that the user visits.

To fix this vulnerability, user input should never be directly embedded into HTML without proper sanitization or escaping. The Ruby on Rails framework provides several helper methods for this purpose, such as html_escape or h, which can be used to ensure that any potentially dangerous characters are properly escaped before they are included in the HTML output.

Steps​

  • Sanitize user input: Ensure that any user input is properly sanitized before being used in the application.
  • Use strong parameterization: Implement strong parameterization to whitelist and validate user input before using it in the application.
  • Implement Content Security Policy (CSP): Set up a Content Security Policy to restrict the types of content that can be loaded by the application, preventing the execution of malicious scripts.
  • Use output encoding: Always encode user-generated content before displaying it to prevent cross-site scripting attacks.
  • Implement input validation: Validate user input to ensure it meets the expected format and does not contain any malicious code.
  • Keep dependencies up to date: Regularly update the Ruby on Rails framework and any third-party libraries used in the application to ensure that known vulnerabilities are patched.
  • Educate developers: Provide training and resources to developers to raise awareness about cross-site scripting vulnerabilities and best practices for secure coding.
  • Implement secure coding practices: Follow secure coding practices, such as avoiding the use of eval() and using parameterized queries instead of string concatenation when interacting with databases.

Compliant code​

class PostsController < ApplicationController
  def show
    @post = Post.find(params[:id])
    @comment = @post.comments.build
    @comment.content = sanitize(params[:comment_content])
  end

  private

  def sanitize(input)
    ActionController::Base.helpers.sanitize(input)
  end
end

The original code was vulnerable to Universal Cross-Site Scripting (UXSS) because it directly used user input (params[:comment_content]) without sanitizing it. This could allow an attacker to inject malicious scripts that would be executed when the content is displayed.

The fixed code introduces a new private method sanitize(input), which uses Rails' built-in ActionController::Base.helpers.sanitize(input) method to sanitize user input before assigning it to @comment.content. This method strips out any potentially harmful HTML tags from the input, preventing the possibility of script injection.

In addition to this code fix, it's important to follow the steps mentioned earlier to further secure the application. These include implementing strong parameterization, setting up a Content Security Policy (CSP), using output encoding, validating user input, keeping dependencies up to date, educating developers about secure coding practices, and following secure coding practices.

References​

Last updated on