187
Strategy = Output Encoding
Use and specify an output encoding that can be handled by the downstream component that
is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an
encoding is not specified, a downstream component may choose a different encoding, either
by assuming a default encoding or automatically inferring which encoding is being used, which
can be erroneous. When the encodings are inconsistent, the downstream component might
treat some character or byte sequences as special, even if they are not special in the original
encoding. Attackers might then be able to exploit this discrepancy and conduct injection attacks;
they even might be able to bypass protection mechanisms that assume the original encoding is
also being used by the downstream component. The problem of inconsistent output encodings
often arises in web pages. If an encoding is not specified in an HTTP header, web browsers
often guess about which encoding is being used. This can open up the browser to subtle XSS
attacks.
Phase: Implementation
With Struts, write all data from form beans with the bean's filter attribute set to true.
Phase: Implementation
Strategy = Attack Surface Reduction
To help mitigate XSS attacks against the user's session cookie, set the session cookie to be
HttpOnly. In browsers that support the HttpOnly feature (such as more recent versions of Internet
Explorer and Firefox), this attribute can prevent the user's session cookie from being accessible
to malicious client-side scripts that use document.cookie. This is not a complete solution, since
HttpOnly is not supported by all browsers. More importantly, XMLHTTPRequest and other
powerful browser technologies provide read access to HTTP headers, including the Set-Cookie
header in which the HttpOnly flag is set.
Effectiveness = Defense in Depth
Observed Examples
Reference Description
CVE-2005-0563 Cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access
(OWA) component in Exchange Server 5.5 allows remote attackers to inject
arbitrary web script or HTML via an email message with an encoded javascript:
URL ("jav&#X41sc&#0010;ript:") in an IMG tag.
https://www.cve.org/CVERecord?id=CVE-2005-0563
CVE-2005-2276 Cross-site scripting (XSS) vulnerability in Novell Groupwise WebAccess
6.5 before July 11, 2005 allows remote attackers to inject arbitrary web
script or HTML via an e-mail message with an encoded javascript URI (e.g.
"j&#X41vascript" in an IMG tag).
https://www.cve.org/CVERecord?id=CVE-2005-2276
CVE-2005-0692 Encoded script within BBcode IMG tag.
https://www.cve.org/CVERecord?id=CVE-2005-0692
CVE-2002-0117 Encoded "javascript" in IMG tag.
https://www.cve.org/CVERecord?id=CVE-2002-0117
CVE-2002-0118 Encoded "javascript" in IMG tag.
https://www.cve.org/CVERecord?id=CVE-2002-0118
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
CWE Version 4.14
CWE-85: Doubled Character XSS Manipulations
CWE-85: Doubled Character XSS Manipulations