Preventing reflected XSS attacks in static asset requests in node/express

Question

Preventing reflected XSS attacks in static asset requests in node/express

After conducting a penetration test using the Burp tool on my node(express)/angular application, I discovered a reflected XSS vulnerability. This vulnerability was specifically identified when making a GET request for static assets (no other vulnerabilities were found during user interactions with the application).

The issue description is as follows:

An arbitrary URL parameter's name is inserted into a JavaScript expression without any quotation marks. The payload 41b68(a)184a9=1 was submitted through this URL parameter and echoed back unmodified in the application's response.

This behavior indicates the ability to inject JavaScript commands into the document. Although an attempt to exploit this vulnerability was unsuccessful, manual examination of the application's behavior is recommended to identify any unusual input validation or obstacles.

To test the vulnerability, an arbitrary URL parameter was passed in the following format:

GET /images/?41b68(a)184a9=1

The response received was:

HTTP/1.1 404 Not Found
X-Content-Security-Policy: connect-src 'self'; default-src 'self'; font-src 'self'; frame-src; img-src 'self' *.google-analytics.com; media-src; object-src; script-src 'self' 'unsafe-eval' *.google-analytics.com; style-src 'self' 'unsafe-inline'
X-XSS-Protection: 1; mode=block
X-Frame-Options: DENY
Strict-Transport-Security: max-age=10886400; includeSubDomains; preload
X-Download-Options: noopen
X-Content-Type-Options: nosniff
Content-Type: text/html; charset=utf-8
Content-Length: 52
Date: Wed, 08 Oct 2015 10:46:43 GMT
Connection: close

Cannot GET /images/?41b68(a)184a9=1

The application has implemented Content Security Policy (CSP) via Helmet, ensuring protection against exploits. While the app uses HTTPS, it does not require user authentication. CSP restricts requests to the app's domain and Google Analytics.

The pen test report suggests validating input (which is already being done), encoding HTML (handled by Angular by default), and evaluating the behavior of static asset requests within Node/Express.

Exploring solutions to prevent or mitigate this issue for static asset requests:

Should all application requests be whitelisted under CSP?
Can domains be whitelisted instead of individual requests?
Should responses to static asset requests be encoded in some manner?
Could the vulnerability lie in the code handling static asset responses?
Is there a possibility of the GET request parameter being evaluated in the application code?

Update

Initial investigations point towards escaping data in URL parameter values and sanitizing input in URLs as part of mitigation strategies. Escaping of the URL is already in place:

curl 'http://mydomain/images/?<script>alert('hello')</script>'

Resulting in:

Cannot GET /images/?&lt;script&gt;alert(hello)&lt;/script&gt;

Addition of express-sanitized has also been implemented for further security measures.

However, testing the original scenario still reflects the request parameter back:

curl 'http://mydomain/images/?41b68(a)184a9=1'
Cannot GET /images/?41b68(a)184a9=1

This behavior can be attributed to the absence of HTML insertion in the URL.

All responses to static asset GET requests are handled through

app.use(express.static('static-dir'))

, which processes the query accordingly. express.static utilizes dependencies like serve-static and parseurl.

angularjs node.js security express content-security-policy

Answer 1

Answer №1

The issue arises from the response generated by Express for invalid GET requests, which typically looks like:

Cannot GET /pathname/?yourQueryString

This response may be suitable in many cases, including serving static assets. However, there are situations where only requests for specific static assets should be considered valid, such as:

GET /pathname/your-file.jpg

In my scenario and possibly for others, a custom 404 handler is in place to handle these instances:

var data = {
    status: 404,
    message: 'Not Found',
    description: description,
    url: req.url
};

This custom handling is implemented for invalid template requests in app.js using:

app.use('/template-path/*', function(req, res, next) {
    custom404.send404(req, res);
});

To address requests to static folders explicitly, I have now included dedicated handlers:

app.use('/static-path/*', function(req, res, next) {
        custom404.send404(req, res);
});

If needed, an additional step could involve removing request query parameters before returning the 404 response:

var data = {
    status: 404,
    message: 'Not Found',
    description: description,
    url: url.parse(req.url).pathname // requires var url = require('url')
};

Answer 2

The issue arises from the response generated by Express for invalid GET requests, which typically looks like:

Cannot GET /pathname/?yourQueryString

This response may be suitable in many cases, including serving static assets. However, there are situations where only requests for specific static assets should be considered valid, such as:

GET /pathname/your-file.jpg

In my scenario and possibly for others, a custom 404 handler is in place to handle these instances:

var data = {
    status: 404,
    message: 'Not Found',
    description: description,
    url: req.url
};

This custom handling is implemented for invalid template requests in app.js using:

app.use('/template-path/*', function(req, res, next) {
    custom404.send404(req, res);
});

To address requests to static folders explicitly, I have now included dedicated handlers:

app.use('/static-path/*', function(req, res, next) {
        custom404.send404(req, res);
});

If needed, an additional step could involve removing request query parameters before returning the 404 response:

var data = {
    status: 404,
    message: 'Not Found',
    description: description,
    url: url.parse(req.url).pathname // requires var url = require('url')
};

Preventing reflected XSS attacks in static asset requests in node/express

Update

Answer №1

Similar questions

The POST method in Node JS request-promises does not properly handle string inputs

Update JSON data in ng-blur event using AngularJS

Tips for efficient navigation through posts when they are loaded via a JSON file

Filter the ng-repeat list dynamically by triggering ng-click event

Storing data in a TypeBuffer and then retrieving it from a file can lead to surprising outcomes

I'm building an angular website and considering using Ionic to develop the corresponding mobile apps. Can you recommend the simplest approach for this integration?

Tips for adding an array to an array of objects with AngularJs

Issues with ng-repeat causing the Angular Editable table to malfunction

Using middleware in Express to handle GET requests

nvd3 - multiBarHorizontalChart - total exceeds 100%

Converting JSON DateTime objects to local time in JQuery without considering timezones

How can I include already installed packages in the 'dependencies' and 'devDependencies' sections of my package.json file after deleting the original package.json?

What steps do I need to follow in order to utilize Express Generator to create a node skeleton with an HTML view

Leveraging functions in a Node.js module

Disable location prompt feature when using AngularJS with Maps API

I'm encountering an issue where the database table in Postgres is not updating correctly while working with Node

What is the best way to send two mongoose find queries to the correct GET route?

Tips for setting up a React TypeScript project with custom folder paths, such as being able to access components with `@components/` included

Strategies for capturing a 404 error in an Express router

Node.js sessions cookies are not being generated properly as req.cookies['connect.sid'] is not being created, and req.sessionID is changing every time the page is refreshed