Description

Stored XSS attack, also known as persistent XSS attack, refers to a type of web application vulnerability where the attacker injects malicious code or script into the web application, typically into a database or other storage mechanism, and later the code/script is delivered to an unsuspecting client through a normal request. User-Agent header is a part of the HTTP request header that identifies the operating system, browser, and other software that the client is using to communicate with the server. An attacker can exploit this vulnerability by injecting malicious code into the User-Agent header. When a server receives such a request, it stores the User-Agent header in its database or other storage mechanism. Later when the server responds to a legitimate request with this User-Agent header from the attacker's machine, the malicious code is executed in the victim's browser, leading to theft of sensitive information and other malicious actions. To prevent a Stored XSS attack through User-Agent header, web application developers should ensure that all user input is properly sanitized and validated before being stored, and implement measures such as input validation and data filtering to minimize the risk of malicious code injection.

Proof of Concept

POST /demo/index.php/authentication HTTP/1.1
Host: i-librarian.net
Cookie: IL=ra0tisri54880n9re39hefjbvv
Content-Length: 108
Sec-Ch-Ua: "Chromium";v="111", "Not(A:Brand";v="8"
Sec-Ch-Ua-Mobile: ?0
User-Agent: <script>window.location.href = 'https://www.google.com';</script>
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: application/json, text/javascript, */*; q=0.01
X-Client-Width: 1920
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Platform: "macOS"
Origin: https://i-librarian.net
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://i-librarian.net/demo/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

username=user&password=user42user&csrfToken=58d5f8fb6393d79bafae6d7c838d845c6898527015d44d47ad5cd2734f72b47a

Impact

The impact of a Stored XSS attack at User-Agent header can be severe. An attacker can use this vulnerability to inject malicious code or scripts into the victim's browser, including code that can redirect the victim to other malicious websites. This can significantly impact the availability and usability of the victim's system. Therefore, it is essential for web application developers to take this vulnerability seriously and implement proper security measures to prevent it.