Is it possible to do XSS attacks via html comments with JSP code inside?
Yes, what you are looking at is a reflexive XSS attack. This is dangerous because it allows an attacker to hijack the authenticated session. If you have this code running on your system, an attacker would be able to access other people's accounts without knowing their username / password.
XSS vulnerabilities can also be exploited to bypass CSRF protection . This is because XSS allows an attacker to read the CSRF token value using XmlHTTPRequest. XSS can also be used to trick summarization checks.
Here is an easy way to manually test the xss, this is where I get out of the HTML comment for javascript execution.
http://localhost/xss_vuln.jsp?paramName='--><script>alert(document.cookie)</script><!--'
This is a free xss scanner , you should test all the applications you write.
a source to share
The JSP parser treats HTML comments as template text . He does not ignore its content. HTML comments are ignored only by HTML parsers / interpreters (webbrowsers!). Instead, you should use JSP comments to prevent the JSP engine from processing a specific piece of code.
<%-- <%=paramName%>=<%=request.getParameter(paramName)%><BR> --%>
Note the style <%-- --%>
, not the <!-- -->
HTML comment style . The JSP parser will not parse them, but will remove them from the output. This way you won't see them in the generated HTML output.
The XSS risk is here because you are not using a custom login. Request parameters are completely controlled by supporters. The end user can, for example, pass --><script>alert('xss')</script><!--
as a parameter value and it will be executed. This opens the door for XSS and CSRF attacks. A malicious script could, for example, send all cookies with an ajax request to a malicious server. An attacker could then simply copy the cookie value to be able to log in as himself.
You have to use JSTL c:out
tag or fn:escapeXml
to exit user driven input. I've talked about this in detail several times before, under each one here . More explanation about CSRF can be found in my answer here .
a source to share