paragbagul111
commented
3 weeks ago Vulnerability Name: Stored Cross Site Scripting in Profession Field
Interview Bot v1.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via the "profession" field, allowing an attacker to inject malicious HTML and JavaScript payloads.
Affected component(s):
Interview Bot web application (version 1.0) "Profession" input field on the login page Attack vector(s):
Web-based: The vulnerability can be exploited by submitting malicious payloads through the "profession" field on the login page. The injected HTML and JavaScript are rendered and executed in the browser of other users who view the page. Steps to Reproduce:
Navigate to the Interview Bot web application at: https://technodes2-0.github.io/Interview-Bot/.
In the "profession" field, inject the following payload: '"><img src="x" onerror=prompt()>.
Submit the form and log in.
Observe that the JavaScript payload is executed, triggering the prompt() function in the browser, demonstrating the successful execution of the XSS attack.
Impact:
Session Hijacking: Attackers may steal session cookies or tokens, potentially gaining unauthorized access to users' accounts. Data Theft: Malicious scripts could access sensitive data stored in cookies or local storage. Defacement: Attackers could alter the appearance of the web page, causing confusion or misleading users. Malware Distribution: XSS attacks could redirect users to malicious websites or infect them with malware. Redirection to Malicious Websites: Attackers could inject payloads that redirect users to phishing or malicious sites. Recommendation:
Input Validation: Ensure that all user input in the "profession" field is validated and sanitized to strip out or properly encode any HTML, JavaScript, or other potentially dangerous content. Output Encoding: Always encode user-generated content before rendering it on the page to prevent the execution of injected scripts. For example, encode special characters like <, >, and & to their respective HTML entities. Content Security Policy (CSP): Implement a strict CSP to mitigate the impact of XSS attacks by restricting the sources from which scripts, images, and other resources can be loaded. Browser Security Features: Enable features such as HTTP-only cookies, same-site cookies, and other browser-level security mechanisms to reduce the risk of session hijacking and data theft.
Vulnerability Name: Cross-Site Scripting (XSS)
Description: Cross-Site Scripting (XSS) is a security vulnerability typically found in web applications. It allows an attacker to inject malicious scripts into web pages viewed by other users. These scripts can hijack user sessions, deface websites, or redirect the user to malicious sites.
Impact:
Session hijacking Data theft (cookies, session tokens) Defacement of web pages Malware distribution Redirection to malicious websites
Step to Reproduce:
1.Open the following URL in your web browser: https://technodes2-0.github.io/Interview-Bot/ 2.In the "name" field, input HTML tags like
<img src=x>along with entering a random profession. 3.After logging in, observe the broken image tag indicating the successful injection of HTML. 4.Further, input the following string in the "name" field:helllo<h1>helo</h1>5.Note the HTML tags are rendered as plain text. 6.Now, inject a JavaScript payload in the "name" field:<img src=x onerror=alert("hacked")>7.After logging in again, observe that the JavaScript payload executes, demonstrating successful XSS.Recommendation: Validate and sanitize user inputs to strip out or encode HTML, JavaScript, and other potentially dangerous content. Encode output to ensure that any user-generated content is treated as plain text rather than executable code. Implement a strict CSP to mitigate the impact of XSS attacks by restricting the sources from which certain types of content can be loaded.