Reflected Cross-Site Scripting in SharePoint Search Box Web Part

0
votes

While a third party company executing a security assessment on our SharePoint 2013 project. The Security Assessment was comprised of a Vulnerability Assessment. The Cycura determined that the "Search Box Web Part" functionality is vulnerable to XSS attacks.

The Proof of Concept came up like below:

Vulnerable parameter: "k":"String"
Payload: "test"><a onmouseover="alert('xss')">xxx
GET /Pages/SearchResults.aspx?k=test"><a onmouseover="alert('xss')">xxx HTTP/1.1 Host: wwwqa.xyz.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:53.0) Gecko/20100101 Firefox/53.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 
Accept-Encoding: gzip, deflate, br 
Cookie: _ga=GA1.3.911615250.1492781812; dtLatC=31; dtPC=256094571_636h3; WSS_FullScreenMode=false; SearchSession=4d21f382%2D23e3%2D4f86%2D91ad%2Dc6c712e70704; 
_gat_UA-82498113-1=1; dtCookie=911302E10B144FAA0C644F92C2950F93|UUErZUN1c3RvbWVyfDE 
Connection: close

Upgrade-Insecure-Requests: 1enter image description here The recommendations was to perform sanitization and input validation on user supplied data. the steps of validation, sanitization and escaping should happen both in client and server side. Whenever possible.

Did anyone had the same security assessment issue and if anyone managed to resolve or get an idea how to manage that since this is using SP OOTB search box web parts.

Much appreciate your help and contributions.

1
sharepoint-2013xss

1 Answers

0
votes

XSS can be prevented by defining white-list of acceptable charaters in user input. The key to prevent this attack is never trust user data. Always sanitize the user input. Always perform data validation i.e whether it has some blacklist characters[character which should not be allowed to user input] on input output both. https://www.owasp.org/index.php/Data_Validation.

This link will help you to understand data sanitazation,validation. https://www.troyhunt.com/understanding-xss-input-sanitisation/

Here is the prevention cheat sheet for XSS. https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet. https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet