Is it possible to make XSS attacks through html comments with JSP code inside?

Question

Hello! Is it true that following code adds a XSS vulnerability to some JSP page?

<!--    <%=paramName%>=<%=request.getParameter(paramName)%><BR>  -->

It looks like a "leftover debug" and definitely should be removed from the code, but how dangerous is it?

Answer 1

Yes, what you are looking at is a reflective XSS attack. This is dangerous because it allows an attacker to hijack an authenticated session. If you have this code running on your system, an attacker will be able to access other peoples accounts without needing to know their username/password.

XSS vulnerabilities can also be used to bypass CSRF protection. This is because XSS allows the attacker to read the value of a CSRF token using XmlHTTPRequest. XSS can also be used to fool referer checks.

Here is simple way to manually test for xss, here i am breaking out of the HTML comment to execute javascript.

http://localhost/xss_vuln.jsp?paramName='--><script>alert(document.cookie)</script><!--' 

This is a free xss scanner, you should test all applications that you write.

Answer 2

The JSP parser handles HTML comments as template text. It doesn't ignore its contents. The HTML comments are only ignored by HTML parsers/interpreters (webbrowsers!). You should use JSP comments instead to prevent the JSP parser from processing the particular piece of code.

<%--    <%=paramName%>=<%=request.getParameter(paramName)%><BR>  --%>

Note the <%-- --%> style as opposed to <!-- --> HTML comment style. The JSP parser won't parse them, but it removes them from the output. Thus you won't see them in the generated HTML output.

The XSS risk is here because you're not escaping user-controlled input here. Request parameters are fully controllable by endsers. The enduser may for instance pass --><script>alert('xss')</script><!-- as parameter value and it would get executed. This puts the doors wide open for XSS and CSRF attacks. The malicious script may for example send all cookies by an ajax request to a malicious server. The attacker can then just copy the cookie value to be able to be logged in as yourself.

You should use JSTL c:out tag or fn:escapeXml function to escape user-controlled input. I've answered this in detail several times before, under each here. More explanation about CSRF can be found in my answer here.