Cross-site scripting (XSS)

"This server is vulnerable to a cross-site scripting attack. Make sure the client-side (JavaScript) data is secure and validated."

Problem

Cross-site scripting is a web attack on vulnerable web applications using JavaScript. Malicious content is delivered to JavaScript-enabled users via an unsafe or untrusted source by composing the data to a dangerous sink inside the Document Object Model (DOM) rather than in HTML which presents a regular XSS.

XSS attacks happen when the input data to a web application is not validated and the output data to the browser is not encoded in HTML.

When XSS attacks are successful, attackers can:

  • Hijack an account.
  • Spread web worms.
  • Access browser history and clipboard contents.
  • Control the browser remotely.
  • Scan and exploit intranet appliances and applications.

Solution

To identify and prevent XSS errors in web applications:

  1. Validate the data entered by user browsers in the web application.

  2. Encode all output to user browsers from the web application.

  3. Give users the ability to disable client-side scripts.

Informazioni

DigiCert is the world's leading provider of scalable TLS/SSL, IoT and PKI solutions for identity and encryption. The most innovative companies, including 89% of the Fortune 500 and 97 of the 100 top global banks, choose DigiCert for its expertise in identity and encryption for web servers and Internet of Things devices. DigiCert supports TLS and other digital certificates for PKI deployments at any scale through its certificate lifecycle management solution, CertCentral®. The company is recognized for its enterprise-grade certificate management platform, fast and knowledgeable customer support, and market-leading security solutions. For the latest DigiCert news and updates, visit digicert.com or follow @digicert.

©2020 DigiCert, Inc. All rights reserved. DigiCert, its logo and CertCentral are registered trademarks of DigiCert, Inc. Norton and the Checkmark Logo are trademarks of NortonLifeLock Inc. used under license. Other names may be trademarks of their respective owners.