Web Application Defender's Cookbook

Recipe 10-2: Preventing Cross-Site Scripting (XSS) Attacks

This recipe shows you how to figure out when attackers attempt to use path-traversal requests to access unauthorized data.

Ingredients

• OWASP ModSecurity Core Rule Set (CRS)
  • modsecurity_crs_41_xss_attacks.conf
• ModSecurity
  • REQUEST_URI variable
  • REQUEST_BODY variable
  • REQUEST_HEADERS variable
  • XML variable

CAPEC-63: Simple Script Injection

An attacker embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users’ privilege level.

An attack of this type exploits a program’s vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.

http://capec.mitre.org/data/definitions/63.html

Sample Attack

In April 2010, the Apache.org web site came under a wide attack targeting many different systems and using a variety of methods. One was a reflected XSS attack.

The attackers targeted the Apache JIRA admins by creating a ticket containing the following data:

ive got this error while browsing some projects in jira http://tinyurl.com/XXXXXXXXX [obscured]

Any JIRA admin ...