Cross-site scripting

Cross-site scripting
Name	Cross-site scripting
Abbreviation	XSS
Type	Security vulnerability
First reported	1999
Affected	Web applications, browsers, content management systems
Mitigation	Input validation, output encoding, Content Security Policy, HTTPOnly cookies

Cross-site scripting is a class of web application vulnerability that enables attackers to inject client-side scripts into web pages viewed by other users. It affects web applications, browsers, content delivery networks, and content management systems by exploiting insufficient output encoding and input validation in server-side software such as Apache HTTP Server, Nginx (web server), Microsoft Internet Information Services, PHP, Node.js, Ruby on Rails, Django, and ASP.NET. Major incidents have involved organizations like Google, Facebook, Twitter, Yahoo!, Microsoft Corporation and institutions including Harvard University, Stanford University, Massachusetts Institute of Technology, United States Department of Defense, and European Commission.

Overview

Cross-site scripting vulnerabilities arise when applications fail to sanitize user-controlled data before including it in HTML, JavaScript, or other client-side contexts delivered to browsers like Google Chrome, Mozilla Firefox, Microsoft Edge, Safari (web browser), and Opera (web browser). Attackers leverage weaknesses in platforms and frameworks such as WordPress, Joomla!, Drupal, Magento, SharePoint, Salesforce, Shopify, Atlassian, GitHub, GitLab, Stack Overflow, and Reddit to execute scripts that can steal session tokens, perform actions on behalf of victims, or deface content. Vulnerability research and disclosure have been advanced by organizations and events including CERT Coordination Center, Open Web Application Security Project, Bugcrowd, HackerOne, Black Hat (conference), DEF CON, RSA Conference, OWASP Top Ten, and researchers at Google Project Zero.

Types

Reflected, stored, and DOM-based variants are the canonical categories used by security teams at institutions like National Institute of Standards and Technology, MITRE, European Union Agency for Cybersecurity, and vendors such as Symantec, McAfee, CrowdStrike, and Palo Alto Networks. Reflected XSS commonly occurs in search forms or URL parameters processed by frameworks including Express (software), Flask (web framework), Laravel, Symfony (software) and APIs hosted on platforms such as Amazon Web Services, Microsoft Azure, Google Cloud Platform, Heroku, and DigitalOcean. Stored XSS appears in persistent storage used by database systems like MySQL, PostgreSQL, MongoDB, Redis, and SQLite within applications deployed on stacks such as the MEAN stack and LAMP (software bundle). DOM-based XSS involves client-side code executed in libraries and runtimes like jQuery, React (JavaScript library), AngularJS, Vue.js, Backbone.js, and browsers’ Document Object Model implementations.

Attack Techniques and Payloads

Attackers craft payloads that exploit contexts in HTML attributes, script blocks, CSS, and URI handlers used by platforms such as Content Management System, SMTP (protocol), WebSocket protocol, and integrations with services like Google Analytics, Facebook Graph API, Twitter API, LinkedIn API and OAuth 2.0. Techniques include HTML injection in comment systems on sites like YouTube, Wikipedia, and Medium (website), cookie theft via HTTP cookie manipulation, keylogging with JavaScript event handlers, DOM mutation using APIs standardized by World Wide Web Consortium, and blind XSS that triggers out-of-band callbacks to infrastructures like Burp Suite, OWASP ZAP, Metasploit Framework, Kali Linux, Cobalt Strike, and Splunk. Complex chains combine vulnerabilities across services including Cross-Origin Resource Sharing, SameSite cookie, Content Security Policy, and federated identity systems such as SAML 2.0 and OpenID Connect.

Detection and Prevention

Detection relies on static analysis tools and dynamic scanners produced by companies and projects such as Veracode, Checkmarx, SonarQube, Fortify (software), Nessus, Acunetix, Qualys, Tenable, and open-source suites like OWASP ZAP. Prevention measures endorsed by standards bodies like IETF and agencies like NIST include context-aware output encoding libraries (for example those bundled with Apache Struts, Spring Framework, Microsoft ASP.NET MVC), input validation routines, parameterized queries to SQL (Structured Query Language), use of security headers implemented in NGINX or IIS, and adopting browser mitigations in Chromium and Gecko (software platform). Enterprise practices involve secure development lifecycle processes advocated by Microsoft Security Development Lifecycle, NIST Secure Software Development Framework, and compliance frameworks such as PCI DSS, GDPR, HIPAA, SOX, and contractual requirements used by IBM and Deloitte.

Impact and Examples

High-profile disclosures have affected companies like eBay, PayPal, LinkedIn, MySpace, AOL, Sony, Adobe Systems, Twitter (now X), Instagram, Snapchat, WhatsApp, Slack Technologies, and public services of United Kingdom Government portals and Australian Government websites. Consequences include account takeover, data exfiltration, reputational damage, and regulatory penalties enforced by bodies such as Federal Trade Commission, European Court of Justice, Information Commissioner's Office (United Kingdom), Australian Competition and Consumer Commission, and Japan Fair Trade Commission. Notable research demonstrations have been published by contributors affiliated with University of Cambridge, Stanford University, Carnegie Mellon University, Massachusetts Institute of Technology, University of California, Berkeley, and private labs at Google, Microsoft Research, Facebook AI Research, and Intel Labs.

Legal and Ethical Considerations

Legal responses involve law enforcement agencies and legal frameworks including United States Computer Fraud and Abuse Act, Council of Europe Convention on Cybercrime, Network and Information Security Directive (NIS Directive), Digital Millennium Copyright Act, and national data protection statutes such as California Consumer Privacy Act and General Data Protection Regulation. Ethical disclosure practices are guided by community norms at IEEE, ACM, FIRST (organisation), and coordinated disclosure programs run by CERT/CC and vendor-specific policies at Google Vulnerability Reward Program, Facebook Bug Bounty, Microsoft Bug Bounty, Apple Security Bounty, and HackerOne. Incident response and forensics often involve collaboration with firms like Mandiant, Kroll, CrowdStrike, and public agencies including FBI, Cybersecurity and Infrastructure Security Agency, National Cyber Security Centre (United Kingdom), and Europol.

Category:Computer security