I recently became the security administrator of a website. I'm not a security master, but I took it as a chance to actually understand how security works nowadays.

The website has a chat function, and I was wondering "Is this chat vulnerable to XSS?" So I tried to see which characters are escaped because since the chat is a prefab, nobody can tell me how it works. I found that the <> are escaped, however I can use the command: [img]www.anywbsite.com/image.jpg[/img] and it will show a preview of the image on the chat.

This way it seems pretty safe, the problem is that I can put any url at all, even urls that do not exist, as long as it has a "www" and a ".com" at the end it will run the command.

I was wondering, is there any way I can form a url into a script? or something like that.

  • You're asking us to pentest your website or what? – Rápli András Feb 6 '17 at 7:18
  • 1
    What if you put quotes in the url ? – Xavier59 Feb 6 '17 at 7:19
  • Whether you can form a URL that will trigger an action on your chat function will depend on what the code for the chat room does. – schroeder Feb 6 '17 at 7:24
  • 2
    I'd start by avoiding to post a potentially vulnerable site address (or it's equivalent.. Found your site in 1 easy google query thanks to your screenshot.. The html is indexed..) on security (or any publicly accessible) sites. Please outsource a pentest.. You just made your website more vulnerable via this post, and given your explanations I doubt that a self-assessment would be thorough and could give you an illusion of security – niilzon Feb 6 '17 at 12:35
  • @niilzon you don't even need to put any effort into a google search when you can just use functionality on this site – d0nut Feb 6 '17 at 21:39

The spec says that src attribute must lead to non-scripted and non-interactive content, so it seems safe to let any URI in there.

The src attribute must be present, and must contain a valid non-empty URL potentially surrounded by spaces referencing a non-interactive, optionally animated, image resource that is neither paged nor scripted.

However, this means you can insert a URI to your own website, and use it for tracking users a bit. I would ensafe it with a whitelist of allowed domains.

Also, you can use it to spoof human reading of the chat (ie: screenshot a chat where admin is yelling, insert it as the picture, and chat may look like a yelling admin). I know no protection against this but human moderation (since it's a "human reading injection").

Last, to sum up the CSRF thing, it's not a chat related issue if a URL like http://targeted.com/doSomething?on=this_user can be inserted: it's misuse of the HTTP GET method by the targeted.com website, not the chat.

Out of the problem of URIs, escaping the < and > is way not enough: the quotes should be escaped too, as long as some other HTML entities (using built-in ensafing functions like htmlentities for PHP). Did you try inserting double quotes " or single quotes ' or backticks ``` or spaces to get out of the src attribute value?

| improve this answer | |


If the chat is vulnerable to XSS or not depends on what exactly the chat software does with the string you put in the [img] tag. Presumably it put it in the src attribute of an img HTML tag. As far as I know full control of the src attribute does not give you the ability to execute scripts, but there might still be some things you could try:

  • If the URL is not propertly filtered or encoded, try something like www.doesnotexist.com" onerror="alert('XSS');" .com.
  • If the URL is not quoted, you might be able to get around a filter by just not using any quotes.
  • If the image is wrapped in an a tag to make it clickable, so the URL ends up in a href attribute as well, you could try javascript:alert('XSS');. No image will be loaded, but if the reciever clicks on it the script will be executed. (Edit: I just noticed the www.*.com requierment. I don't think you could make this point work under that rule.)

There are probably more things you can try as well. Inspect the output HTML of the chat, and try different inputs to try to figure out what is going on behind the curtains.

Other issues

I will only briefly mention these, since your question is about XSS:

  • Privacy. This could be used to get the IP of the person you are chatting with. (Just send them an URL to an image on a server you control, then check the logs.)
  • CSRF. See Rápli András' answer. Not sure I would care about this though, since it is not an issue with your chat.
  • Password theaft. Send a URL for an image protected by basic auth, and the reciever will get a password pop up. It can be used to fool people into entering their credentials for the chat.
| improve this answer | |

however I can use a the command [img]www.anywbsite.com/image.jpg[/img],and it will show a preview of the image on the chat

This is not XSS, but it's a bad practice, and it makes your website able to be involved in CSRF attacks.

Whenever an image is preloaded, a HTTP GET request is sent to that URL, so as a book example an attacker could try:


Again, it is not a vulnerability in your website, but attackers can make you the origin of all bad malicious requests to the vulnerable online bank. So I recommend disabling that image preloading feature, or make it preload images from your website only.

Edit: it also works with your website url if you don't use csrf tokens.

| improve this answer | |
  • The bad practice isn't to allow image preview, but to let it be done by the client. Image preview must be done by the server with 0 cookies and send the temp image to the client. – Xavier59 Feb 6 '17 at 7:30
  • That's pretty obvious. I was not expecting the whole web to disable images. – Rápli András Feb 6 '17 at 7:32
  • 1
    It's not a bad practice nor a CSRF attack: CSRF flaws comes from the called website, not the caller. GET requests are supposed to be safe (= information retrieving only), so they can be used in any image. Btw, browser handle the fact of having image only in these tags, and wil discard scripts and such. – Xenos Feb 6 '17 at 8:34
