Cart
|
[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message] What is a CDATA injection attack?
Hi Folks,
Liam Quinn wrote:
> CDATA sections ... tend to be vectors for CDATA injection attacks.
What is a CDATA injection attack?
On the Open Web Application Security Project (OWASP) page [1] it has the following:
------------------------------------------------------------------------
Suppose we have a node containing some text that will be displayed back to the user.
<html>
$HTMLCode
</html>
Then, an attacker can provide the following input:
$HTMLCode = <![CDATA[<]]>script<![CDATA[>]]>alert('xss')<![CDATA[<]]>/script<![CDATA[>]]>
and obtain the following node:
<html>
<![CDATA[<]]>script<![CDATA[>]]>alert('xss')<![CDATA[<]]>/script<![CDATA[>]]>
</html>
During the processing, the CDATA section delimiters are eliminated, generating the following HTML code:
<script>alert('XSS')</script>
The result is that the application is vulnerable to XSS (Cross-site Scripting).
------------------------------------------------------------------------
Is that a CDATA injection attack?
It raises several questions:
1. Their description says,
During the processing, ...
During what processing? XML parsing? Their example looks like HTML so why would there be XML parsing?
2. In their example they used multiple CDATA sections. Why? Couldn't the same attack be obtained using just one:
$HTMLCode = <![CDATA[<script>alert('XSS')</script>]]>
3. Also, couldn't the same attack be obtained by simply escaping the < characters:
$HTMLCode = <script>alert('XSS')</script>
4. If yes, then why is it called a CDATA attack?
/Roger
[1] https://www.owasp.org/index.php/Testing_for_XML_Injection_%28OWASP-DV-008%29
 [Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] |
PURCHASE STYLUS STUDIO ONLINE TODAY!Purchasing Stylus Studio from our online shop is Easy, Secure and Value Priced! 
Download The World's Best XML IDE!Accelerate XML development with our award-winning XML IDE - Download a free trial today! Subscribe in XML format
|
|||||||||
