What is Cross-Site Scripting (XSS) and How to Protect Your Business
Table of Contents
When we use the Internet, we do so with a degree of trust. We navigate to websites and forums, click on links, add our personal details to eCommerce sites, and search and click. We expect to do so safely and securely. Cybercriminals exploit this trust using various techniques, one of which is a Cross-Site Scripting (XSS) attack.
What is a Cross-Site Scripting (XSS) Vulnerability?
When software code executes (runs), it does so on the server or client side. On the client side, it is the browser that runs the script. Software scripts are small pieces of code, usually written in JavaScript, that are legitimately used to retrieve data from databases, display websites, etc. Cross-site scripting (XSS) is a type of injection attack that uses scripts to execute malicious code. XSS exploits a web security vulnerability whereby malicious scripts are injected into web pages. XSS attackers typically use client-side scripts, exploiting a web application to send malicious code.
XSS attacks can lead to severe consequences, including account compromise, data theft, and privilege escalation. Malicious scripts can be disguised using various methods. The browser will be unaware that the script contains malicious code and run it. The malicious script can then access cookies, session tokens, and other sensitive information, with instructions to send it back to the attacker.
Commonly used content management systems and associated web apps often have XSS vulnerabilities:
- XSS is the most common vulnerability in the WordPress ecosystem, with 53% of all vulnerabilities. (Source)
- A million websites that use cPanel are at risk of XSS. (Source)
Types of XSS
The three most common types of XSS attacks are as follows:
Reflected XSS
This is the most common type of XSS attack. The attacker appends the URL of a legitimate website, like your company site, with a malicious script. When someone navigates to that webpage, the browser executes the script, "reflecting" the payload of the script in the user's browser. Often, this type of attack is initiated using social engineering or phishing to manipulate the victim into clicking a link to the affected page.
Persistent (Stored) XSS
A malicious script is injected into a web application that stores the payload in a database or server file for later execution. When a victim navigates to the compromised page, the script runs and executes its malicious code. The stored script remains in place, potentially affecting multiple users.
DOM-Based XSS
DOM-based XSS is a client-side vulnerability based on a page's Document Object Model (DOM). The scripts run entirely client-side. DOM-based attacks are the most difficult to detect as the payload never reaches the server, and all events take place in the user's browser.
How Does an XSS Attack Work?
The following are the typical steps to execute the malicious code behind XSS attacks:
- The attacker designs the attack they wish to carry out and the type of data they are targeting.
- They then determine the most appropriate type of XSS attack for success.
- The design of the attack will determine the methods used to direct a target to the infected webpage. This may be phishing, social engineering, or some other method.
- Once the victim has navigated to the infected webpage, the script will be executed. The attacker then waits for the stolen data to arrive.
Threats to an SMB from XSS
XSS attacks are a stepping stone to broader cyberattacks. Once a malicious script executes, it has access to various information pieces, like cookies containing identifying information. Some malicious scripts can access application programming interfaces (APIs), including those controlling access to microphones and webcams. The stolen data is sent to a cybercriminal to carry out further cyberattacks. Using data stolen using an XSS attack, a cybercriminal can then carry out the following threats to an SMB:
Account Takeover (ATO)
Reflected XSS can be used to carry out an account takeover (ATO) attack. The XSS attack allows the cybercriminal to change the user's email address to one they control. This allows the attacker to reset the account password, allowing them to gain unauthorized access to the user's account.
Other XSS attacks gather the authentication data in a user's session cookie, allowing the user's session and account to be hijacked.
Sensitive Data Theft and Exposure
Most XSS attacks are designed to gather information and send it to a cybercriminal. Data types that can be stolen using XSS vulnerabilities include user input via login pages, registration forms, or contact forms. Any data entered into these forms can be captured by the malicious code and sent to the attacker.
For example, if a user enters their username and password, the injected script will send these login credentials to an external server controlled by the attacker. Similarly, some malicious scripts can initiate the capture of keystrokes and clicks. This data can provide a wealth of sensitive data and company secrets, the output being sent to the attacker.
Damage to Corporate Image
XSS vulnerabilities can allow an attacker to change the details in a press release or news item or deface a website. This can impact a company's brand image and cause a loss of consumer trust.
Manipulate Customers
XSS scripts can be configured to change website instructions. For example, if your company website has instructions on using one of your products, an attacker could modify these instructions, potentially causing your product to fail or even harming a customer.
How Much Would an XSS Attack Cost an SMB?
XSS attacks are damaging and have far-reaching effects. Palo Alto's Unit 42 has identified a trend where attackers no longer just encrypt data to cause disruption; they are now harassing companies and threatening to interrupt critical operations to cause long periods of downtime. The Unit 42 survey found that 86% of incidents had some impact-related loss, including:
- Outright business disruption
- Asset and fraud-related losses
- Brand and market damage as a result of publicized attacks
- Increased operating costs, legal and regulatory costs, and more
Account Takeover Costs
Account takeover (ATO) leads to fraud, identity theft, and the theft of sensitive information. If an executive's email account is compromised, the company could be at risk of a Business Email Compromise (BEC) scam. Fraud takes an average of 14 months to recognize and costs an SMB around $16,000; over half of SMBs (54%) never recover their losses.
Identity Theft
XSS attacks could compromise business accounts. Once an account is hijacked, a cybercriminal can steal a company's credentials, such as a tax identification number and credit details, to obtain goods, services, or credit. Hackers can also sell this data on the dark web to other fraudsters. Identity fraud costs US businesses $23 billion.
Business Email Compromise (BEC) Scams
An XSS attack can compromise a CEO's email account. Once an attacker has control of the account, they can manipulate employees into transferring money to a hacker's bank account. Business losses caused by BEC fraud are $55.5 billion. The average loss to an individual business from BEC scams in the USA is $137,132 per incident.
Sensitive Data and Extortion
If your company secrets or customer details get into the wrong hands, they can be used as ransom. Attackers threaten to release the data on public forums or sell it on the dark web. Alternatively, proprietary data and Intellectual Property (IP) can be sold on the dark web to the highest bidder.
Noncompliance Fines
Various US states enforce data protection and privacy laws by issuing fines to companies that violate the regulations. An example is the Health Insurance Portability and Accountability Act (HIPAA), which affects healthcare organizations and the associated supply chain. HIPAA issues fines of up to $2,134,831 per violation, depending on the seriousness of the data or privacy breach.
Brand and Reputation Damage
XSS attacks that impact customers can lead to a loss of trust and damage. In some extreme cases, an attacker may make changes to instructions on a website that result in material damage to a person's health or a product they use. If the incident is recorded in the public domain, this could result in a court case and further erosion of customer trust.
How To Prevent XSS Attacks
Companies must ensure that an XSS attack cannot compromise their web pages. The following best practices help to ensure that XSS attackers cannot exploit a website and damage a company and its customers:
Secure Website Configuration
Validating and sanitizing user input before it is displayed can prevent XSS attacks that exploit user input. User input sanitization prevents malicious scripts from being injected into a page. Various specialist input sanitizer libraries can be used to prevent script injection.
Output encoding is another way to prevent injected code from being executed. This technique encodes user data before rendering it on the page.
Keep Browsers and Other Software Up-to-Date
Ensure that software, especially browsers, is kept up-to-date with the latest security patches. This prevents the exploitation of security flaws.
Content Security Policy (CSP)
A CSP is configured to only allow scripts from the same domain or other allowed sources to run. It, therefore, stops inline scripts running, i.e., those used in XSS Reflection attacks. However, attackers can still find workarounds for a CSP.
Web Application Firewall (WAF)
A WAF monitors and filters HTTP traffic between applications and the Internet. WAF rules inspect URLs for malicious scripts and block them.
Secure Cookies
XSS attackers often target cookies that may allow the attacker to take over a user's account. HTTPOnly and Secure flags prevent session cookies from being accessible via JavaScript.
Dark Web Monitoring
XSS attacks can result in compromised accounts and data leaks. Dark web monitoring tools look for signs of leaked company data on the dark web. Finding leaked data, such as login credentials, can help reduce the risk of follow-on cyberattacks. Dark web monitoring tools also provide deep insight into the dark web to determine whether attackers target your company.
Security Awareness Training
Many XSS attacks use phishing and social engineering to direct users to a webpage that contains the malicious script. Use security awareness training to educate your employees about phishing and how to identify potential phishing and social engineering attempts.
Regularly Test Your Website
XSS attackers often adjust their tactics to evade detection. It is essential to carry out regular security testing against your website to look for potential exploits. Tools are available to help test websites, and professional Penetration Tests can identify weaknesses in your security.
Real World Examples of XSS Attacks
Zoom Workplace Vulnerability
An XSS flaw in Zoom allowed attackers to inject malicious scripts, potentially putting millions of users at risk. The vulnerability exploited an input validation flaw in Zoom chat, allowing malicious scripts to be injected into sessions. Once executed, the scripts could compromise user sessions and steal credentials.
British Airways
Around 380,000 British Airways customers were affected by an XSS vulnerability in a JavaScript library called Feedify used on the company's website. The malicious script stole customer data and sent it to a server controlled by a hacker. Notably, the server used a similar name to the British Airways domain and was HTTPS-secured. Compromised data included credit card details. BA was fined £20 million for data protection breaches and lost customer trust.