XSS Reflected and XXE Vulnerability Changes by Prince-1110 · Pull Request #432 · SasanLabs/VulnerableApp

Prince-1110 · 2023-02-15T17:45:49Z

No description provided.

XSS reflected validations update

removing directory

XSS Reflected Fix

XSS Reflected Message Update

Prince-1110 · 2023-02-23T17:45:10Z

Hi @hexxdump Please take a look at the changes.

hexxdump · 2023-02-23T18:53:15Z

Hi @hexxdump Please take a look at the changes.

@Prince-1110 ,
@preetkaran20 can point you to the right contact.

preetkaran20 · 2023-02-26T02:40:38Z

Hi @hexxdump Please take a look at the changes.

@Prince-1110 , @preetkaran20 can point you to the right contact.

@hexxdump yeah sure. @Prince-1110 thanks for the PR, give me a day and i will review it.

preetkaran20 · 2023-02-27T00:54:47Z

src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSInImgTagAttribute.java

        }
    }
+
+     // Escape all the input which provides eval expression in a payload


the below method is also escaping other things apart from eval. isn't it?

preetkaran20 · 2023-02-27T00:55:43Z

src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSInImgTagAttribute.java

+
+        String vulnerablePayloadWithPlaceHolder = "<img src=%s width=\"400\" height=\"300\"/>";
+
+        String payload =


what is the difference between level 8 and level 9?

preetkaran20 · 2023-02-27T00:56:25Z

src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSInImgTagAttribute.java

+            vulnerabilityExposed = VulnerabilityType.REFLECTED_XSS,
+            description =
+                    "XSS_HTML_ESCAPE_ON_DIRECT_INPUT_AND_REMOVAL_OF_ONLOAD_FUNCTIONS_WITH_PARENTHESIS_SRC_ATTRIBUTE_IMG_TAG")
+    @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_10, htmlTemplate = "LEVEL_1/XSS")


this one is also same as level 9. am i missing something?

preetkaran20 · 2023-02-27T01:03:59Z

src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSWithHtmlTagInjection.java

+            @RequestParam Map<String, String> queryParams) {
+        String vulnerablePayloadWithPlaceHolder = "<div>%s<div>";
+        StringBuilder payload = new StringBuilder();
+        Pattern pattern = Pattern.compile("eval\\((.*?)\\)");


can you please add an extra blacklist defence to level 3 here?

or make it as level 2 as first level has not defence and level 2 has eval based defence and then move other levels to next levels like level3 becomes level 4 and so on.

preetkaran20 · 2023-02-27T01:07:20Z

src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSWithHtmlTagInjection.java

+            vulnerabilityExposed = VulnerabilityType.REFLECTED_XSS,
+            description =
+                    "XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_ONLOAD_EXPRESSION")
+    @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_10, htmlTemplate = "LEVEL_1/XSS")


so we can reformat, level 8 method which you created can be called level 2, level 9 can be called level 3, level 10 can be called level 4 and then currently level 2 and level 3 can be called level 5 and level 6 respectively.

preetkaran20 · 2023-02-27T01:07:50Z

src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSWithHtmlTagInjection.java

+        return new ResponseEntity<String>(payload.toString(), HttpStatus.OK);
+    }
+
+    // Just adding User defined input(Untrusted Data) into div tag if contains


please add the possible payloads to break the levels.

preetkaran20 · 2023-02-27T01:08:11Z

src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSWithHtmlTagInjection.java

+
+    @AttackVector(
+            vulnerabilityExposed = VulnerabilityType.REFLECTED_XSS,
+            description = "XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_PARANOID")


better to add more description than just paranoid values.

preetkaran20 · 2023-02-27T01:09:03Z

src/main/resources/i18n/messages_en_US.properties

 XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_ANCHOR_SCRIPT_AND_IMG_TAG=Url Parameters are added directly into the div tag if they are not having Script/Image and Anchor tag.
 XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_ANCHOR_SCRIPT_IMG_TAG_AND_ALERT_KEYWORD=Url Parameters are added directly into the div tag if they are not having Script/Image/Anchor tag and Javascript and Alert keywords.
+XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_EVAL_EXPRESSION=Url Parameters are added into the div tag if they are not having eval expression.
+XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_PARANOID=Url Parameter are added into the div tag if they are not having paranoid structure inside the url.


I think it is better to specify what is paranoid structure.

preetkaran20 · 2023-02-27T01:09:29Z

src/main/resources/i18n/messages_en_US.properties

 XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_ANCHOR_SCRIPT_IMG_TAG_AND_ALERT_KEYWORD=Url Parameters are added directly into the div tag if they are not having Script/Image/Anchor tag and Javascript and Alert keywords.
+XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_EVAL_EXPRESSION=Url Parameters are added into the div tag if they are not having eval expression.
+XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_PARANOID=Url Parameter are added into the div tag if they are not having paranoid structure inside the url.
+XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_ONLOAD_EXPRESSION=Url Parameters are added directly into the div tag if the input url not having eval expressions.


Suggested change

XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_ONLOAD_EXPRESSION=Url Parameters are added directly into the div tag if the input url not having eval expressions.

XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_ONLOAD_EXPRESSION=Url Parameters are added directly into the div tag if the input url not having onload expressions.

preetkaran20 · 2023-02-27T01:11:35Z

src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XXEVulnerability.java

+ *
+ * @author KSASAN preetkaran20@gmail.com
+ */
+@VulnerableAppRestController(descriptionLabel = "XXE_VULNERABILITY", value = "XXEVulnerability")


I think this file was already existing. can you please check?

preetkaran20 · 2023-02-27T01:18:04Z

src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XXEVulnerability.java

+            InputStream in = request.getInputStream();
+            // disabling external Entities and parameter Entities
+            SAXParserFactory spf = SAXParserFactory.newInstance();
+            spf.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", true);


I was checking this flag and seems like by default it is enabled for SAXparser.
https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-88B04BE2-35EF-4F61-B4FA-57A0E9102342.

Also, don't we need other flags to make this level secure?

preetkaran20 · 2023-02-27T01:20:30Z

src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XXEVulnerability.java

+            InputStream in = request.getInputStream();
+            // disabling external Entities and parameter Entities
+            SAXParserFactory spf = SAXParserFactory.newInstance();
+            spf.setFeature("http://javax.xml.XMLConstants/property/accessExternalStylesheet", "");


without below lines

spf.setFeature("http://javax.xml.XMLConstants/property/accessExternalSchema", ""); spf.setFeature("http://javax.xml.XMLConstants/property/accessExternalDTD", "");

will this be secure implementation?

preetkaran20

Thanks for the PR. Added few comments to the PR and also please fix the PR build as it is also failing.

Prince-1110 added 7 commits February 5, 2023 00:30

Add files via upload

36c0a0a

XSS reflected validations update

XSS reflected validation update

74db5fc

Delete reflected directory

8a1b964

removing directory

Add files via upload

0c3850a

XSS Reflected Fix

Add files via upload

75a88b8

XSS Reflected Message Update

XSS Reflected and XXE Changes

719d2d7

XSS Reflected and XXE message addition

e3ef791

preetkaran20 reviewed Feb 27, 2023

View reviewed changes

preetkaran20 requested changes Feb 27, 2023

View reviewed changes


		String vulnerablePayloadWithPlaceHolder = "<img src=%s width=\"400\" height=\"300\"/>";

		String payload =

	XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_ONLOAD_EXPRESSION=Url Parameters are added directly into the div tag if the input url not having eval expressions.
	XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_ONLOAD_EXPRESSION=Url Parameters are added directly into the div tag if the input url not having onload expressions.

Uh oh!

Conversation

Prince-1110 commented Feb 15, 2023

Uh oh!

Prince-1110 commented Feb 23, 2023

Uh oh!

hexxdump commented Feb 23, 2023

Uh oh!

preetkaran20 commented Feb 26, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

preetkaran20 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

preetkaran20 left a comment •

edited

Loading