Legacy Site vulnerable to XSS Attack [closed] - xss

Question

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question appears to be off-topic because it lacks sufficient information to diagnose the problem. Describe your problem in more detail or include a minimal example in the question itself.
Closed 8 years ago.
Improve this question
I'm experiencing XSS in a legacy site.
The Parameter vulnerable to this attack is: ldapSearch.jsp?f=
After adding the XSS payload to check whether it is vulnerable or not: "><img src=x onerror=prompt(0);>
The URL will look like:
http://idenservices.hostname.com/axrac/ldapSearch.jsp?f=%22%3E%3Cimg%20src=x%20onerror=prompt%280%29;%3E
The XSS pop up comes up and proves that the site is vulnerable to XSS attacks.
Snippet from JSP
<tr>
<td class="required">*</td>
<td class="label"><h3>Enter User's Core ID</h3></td>
<td class="field"><input type="text" name="userid" size="25" maxlength="20" onkeypress="return isAlphaNumberKey(event)" onblur="return LowerCaseAlphanumeric(document.getElementById('userid'));">Lookup User</td>
</tr>
Snippet from JS
function userlookup(fieldName, formName)
{
var uri = "/axrac/ldapSearch.jsp?f=" + formName + "&f1=" + fieldName;
msgWindow=open(uri,'lookup','width=600,height=400,resizable=yes,toolbar=no,menubar=no,location=no,directories=no,status=no');
msgWindow.focus();
}
Adding ldapsearch.jsp
<%
String backFieldName = request.getParameter("f1");
String backFormName = request.getParameter("f");
%>
<table width="100%" cellpadding="0" cellspacing="0" border="0" class="PageSubHeader1">
<tr class="bg">
<td class="flag"> </td>
<td class="banner" width="100%"><h2>LDAP Search</h2></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" border="0" class="PageIntroduction">
<tr>
<td class="copy">
<br/>When searching for a person by their name, please provide 2 or more letters for their first and last name.
If less than 2 letters are entered for both fields or if one field is empty, the search may not return any results.
</td>
</tr>
</table>
<p class="HorizontalRule"></p>
<form action='ldapSearchResults.jsp' method='post'>
<input type="HIDDEN" name="backFieldName" value="<%=backFieldName%>">
<input type="HIDDEN" name="backFormName" value="<%=backFormName%>">
<table width="100%" cellspacing="0" border="0" class="Forms">
<tr>
<td class="required">*</td>
<td class="instruction" colspan="2"><h2>Indicates required field</h3></td>
</tr>
<tr>
<td class="required">*</td>
<td class="label"><h3>First Name</h3></td>
<td class="field"><input type=text name='firstName' size="20"></td>
</tr>
<tr>
<td class="required">*</td>
<td class="label"><h3>Last Name</h3></td>
<td class="field"><input type=text name='lastName' size="20"></td>
</tr>
<tr>
<td> </td>
<td class="label" colspan="2"><h3>- Or -</h3></td>
</tr>
<tr>
<td class="required">*</td>
<td class="label"><h3>Core ID</h3></td>
<td class="field"><input type=text name='coreID' size="20"></td>
</tr>
</table>
<p class="HorizontalRule"></p>
<table width="100%" cellpadding="0" cellspacing="0" border="0" class="Buttons">
<tr>
<td><input type="submit" class="systemButton1" value="Submit Form" id="Submit"> <input type="reset" class="systemButton2" value="Reset Form" id="Reset"></td>
</tr>
</table>
</form>
</body>
</html>
I do not see any issue with JavaScript, but still it is prone to XSS attack.Need help in understanding why it is vulnerable and what should I do to fix this.

Answer 1

Need help in understanding why it is vulnerable
You take user input here:
String backFieldName = request.getParameter("f1");
Then your output it, without modification, here:
<input type="HIDDEN" name="backFieldName" value="<%=backFieldName%>">
(You do the same with other data too, but we'll use this for the example).
This allows anyone to craft a link that contains a "> followed by any HTML (including <script> elements or a Payment Required form) they want, send it to someone, and then have their HTML appear on your site when that person follows the link.
and what should I do to fix this.
Either convert any characters with special meaning in HTML to their respective entities, or run the data through a whitelist to filter out potentially bad input.
Further reading: OWASP XSS Prevention Cheat Sheet