PVedagiri182134 (Community Member) asked a question.
Static scan on veracode results basic XSS flaw.
Attack Vector: system_web_mvc_dll.System.Web.Mvc.ActionResult.ExecuteResult
Number of Modules Affected: 1
Description: This call to system_web_mvc_dll.System.Web.Mvc.ActionResult.ExecuteResult() contains a cross-site scripting (XSS) flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. ExecuteResult() was called on the result object, which contains tainted data. The tainted data originated from an earlier call to system_web_mvc_dll.System.Web.Mvc.UrlHelper.GenerateContentUrl.
public class MyCustomRedirectResult : RedirectResult
{
private bool UnauthorizedRedirect { get; set; }
public MyCustomRedirectResult(string url): base(url) { }
public MyCustomRedirectResult(string url, bool unauthorizedRedirect) : base(url)
{
this.UnauthorizedRedirect = unauthorizedRedirect;
}
public override void ExecuteResult(ControllerContext context)
{
try
{
if (context!=null && context.RequestContext.HttpContext.Request.IsAjaxRequest())
{
string destinationUrl = UrlHelper.GenerateContentUrl(Url, context.HttpContext);
if (this.UnauthorizedRedirect)
{
context.HttpContext.Response.StatusCode = (int)System.Net.HttpStatusCode.Unauthorized;
HttpStatusCodeResult result1 = new HttpStatusCodeResult(401);
result1.ExecuteResult(context);
}
else
{
JavaScriptResult result = new JavaScriptResult()
{
Script = "window.location='" + destinationUrl + "';"
};
result.ExecuteResult(context); // Basic XSS flaw
}
}
else
{
base.ExecuteResult(context);
}
}
catch (System.Exception)
{
throw;
}
}
}
Calling Method is
[HttpPost]
public ActionResult RedirectContact(CustomData data)
{
return new MyCustomRedirectResult(Url.Action("Contact", "Home", new
{
Controller = "Home",
Action = "Contact",
Name = data.Value,
}));
}
I tried with some tainted inputs against data.Value and it result encoded parameter
/Home/Contact?Name=_ALL%26javascript%3Aalert%281%29%3B%3Cscript%3Eaasd%3C%2Fscript%3E
/Home/Contact?Name=_ALL%27%3B%20window.alert%281%29%3B%20%27
/Home/Contact?Name=https%3A%2F%2Fwww.google.com
But scanning with veracode finds basic xss flaw. Please help me on how to fix this.
.png){kind=logo}
Hello @PVedagiri182134 (Community Member),
Thank you for your question and for supplying the details.
I can see a few issues with the destinationUrl variable where not only could it be vulnerable to Cross-Site Scripting (CWE-80) but also URL Redirection to Untrusted Site, also known as Open Redirect (CWE-601). Since this is a URL I advise you ensure the base address and protocol is hard-coded within the application (e.g. https://your-application.com/Home) and not constructed from any untrusted source. If any untrusted data is to be used to form part of the URL, it should be appended to this hard-coded base URL after first being validated. I recommend you extract the dynamic component(s) from destinationUrl and perform appropriate validation (e.g. testing against an allow-list of approved controller/endpoints that can be accepted). After you have validated the dynamic part of the destinationUrl I would recommend using an appropriate supported cleanser (https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/IiF_rOE79ANbwnZwreSPGA) that is suitable for the context such as org.owasp.encoder.Encode.forUriComponent (https://owasp.org/owasp-java-encoder/encoder/apidocs/org/owasp/encoder/Encode.html#forUriComponent-java.lang.String-) to cleanse against any XSS payloads and resolve the flaw reported by Veracode Static.
Please note that it is likely your browser was performing the URL encoding you observed if you had entered those values via the browser URL box, rather than something your application has encoded.
You may wish to review this article: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#rule-5-url-encode-before-inserting-untrusted-data-into-html-url-parameter-values.
I hope that helps answer your question.
Kind regards,
Anthony Fielding