CAPEC-592 Stored XSS

An adversary utilizes a form of Cross-site Scripting (XSS) where a malicious script is persistently "stored" within the data storage of a vulnerable web application as valid input.

Initially presented by an adversary to the vulnerable web application, the malicious script is incorrectly considered valid input and is not properly encoded by the web application. A victim is then convinced to use the web application in a way that creates a response that includes the malicious script. This response is subsequently sent to the victim and the malicious script is executed by the victim's browser. To launch a successful Stored XSS attack, an adversary looks for places where stored input data is used in the generation of a response. This often involves elements that are not expected to host scripts such as image tags (<img>), or the addition of event attributes such as onload and onmouseover. These elements are often not subject to the same input validation, output encoding, and other content filtering and checking routines.

1. [Explore] [Survey the application for stored user-controllable inputs] Using a browser or an automated tool, an adversary follows all public links and actions on a web site. They record all the links, the forms, the resources accessed and all other potential entry-points for the web application. The adversary is looking for areas where user input is stored, such as user profiles, shopping carts, file managers, forums, blogs, and logs. 2. [Experiment] [Probe identified potential entry points for stored XSS vulnerability] The adversary uses the entry points gathered in the "Explore" phase as a target list and injects various common script payloads and special characters to determine if an entry point actually represents a vulnerability and to characterize the extent to which the vulnerability can be exploited. 3. [Experiment] [Store malicious XSS content] Once the adversary has determined which stored locations are vulnerable to XSS, they will interact with the web application to store the malicious content. The adversary can have many goals, from stealing session IDs, cookies, credentials, and page content from a victim. 4. [Exploit] [Get victim to view stored content] In order for the attack to be successful, the victim needs to view the stored malicious content on the webpage.

• An application that leverages a client-side web browser with scripting enabled. • An application that fails to adequately sanitize or encode untrusted input. • An application that stores information provided by the user in data storage of some kind.

• [Medium] Requires the ability to write scripts of varying complexity and to inject them through user controlled fields within the application.

• Confidentiality: Read Data • Confidentiality, Authorization, Access Control: Gain Privileges • Confidentiality, Integrity, Availability: Execute Unauthorized Commands • Integrity: Modify Data

• Use browser technologies that do not allow client-side scripting. • Utilize strict type, character, and encoding enforcement. • Ensure that all user-supplied input is validated before being stored.