Re: Custom session tokens and XSS

[Marc Slemko <marcs () znep com>]

On Tue, 12 Aug 2003, PortSwigger wrote:

> I have recently looked at a web application which maintains session state
> using a custom token stored in a hidden form field. Each page within the
> application is accessed using a POST request which includes the token.
>
> Several locations within the authenticated areas of the application exhibited
> XSS-like behaviour (i.e. client data submitted in form and URL querystring
> fields is returned unsanitised to the browser). However (as far as I could
> see) there was no way to exploit this to attack other users. Any request not
> containing a valid session token results in a redirect to the login page. And
> so assuming that only the user knows their own session token, only they could
> frame a malicious request that would succeed in injecting arbitrary
> HTML/JavaScript into their browser.

...as long as there is no way for another page to get a javascript or
vbscript etc. reference to that window, since it could then read
the contents and take the token and do what it wants with it.