Incomplete Denylist to Cross-Site Scripting

Opis

The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.

While XSS might seem simple to prevent, web browsers vary so widely in how they parse web pages, that a denylist cannot keep track of all the variations. The "XSS Cheat Sheet" [REF-714] contains a large number of attacks that are intended to bypass incomplete denylists.

Skutki

• Confidentiality, Integrity, Availability

  Execute Unauthorized Code or Commands

Przykłady podatności

• CVE-2007-5727 Denylist only removes <SCRIPT> tag.
• CVE-2006-3617 Denylist only removes <SCRIPT> tag.
• CVE-2006-4308 Denylist only checks "javascript:" tag

Zaczyna się od

• CWE-184 Incomplete List of Disallowed Inputs

Słabość nadrzędna

• CWE-184 Incomplete List of Disallowed Inputs

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific, Web Based, Web Server

Źródła

1. XSS (Cross Site Scripting) Cheat Sheet — RSnake