Definition
Stored XSS, or Stored Cross-Site Scripting, is a security vulnerability where a malicious script is injected into a web application and stored on the server. This script is delivered to users whenever they visit the affected page, potentially compromising user data and security.How It Works
- 1An attacker finds an input field on a web page that doesn't properly sanitize user input, like comment sections or user profiles.
- 2The attacker injects a malicious script, such as
, into this field. - 3The web application stores this script on the server without proper validation.
- 4When other users access the page, the stored script runs in their browsers, possibly leading to session hijacking or credential theft.
Key Characteristics
- Persistence: The script remains stored on the server, affecting all users who access the page.
- Common Injection Points: Comment sections, user profiles, forum posts, product reviews.
- Impact: Can lead to session hijacking, credential theft, or other harmful activities.
Comparison
| Feature | Stored XSS | Reflected XSS |
|---|---|---|
| Persistence | Script stored on server affecting all users | Script reflected back only to a specific user |
| Common Use Cases | Comments, profiles, posts | Search forms, error messages |
| Detection | Harder due to persistent nature | Easier as it requires specific user interaction |
Real-World Example
The 2005 Samy MySpace worm (CVE-2005-3054) is a classic example of Stored XSS. The worm injected a script into MySpace profiles that spread automatically, affecting over a million users.Detection & Prevention
- Detection: Tools like Burp Suite can scan for XSS vulnerabilities by simulating attacks and identifying script execution points.
- Prevention: Implement output encoding to neutralize malicious scripts and use Content Security Policy (CSP) to restrict script execution.
Common Misconceptions
- Stored XSS is the same as Reflected XSS: They differ in persistence; Stored XSS affects all users, while Reflected XSS targets individual users.
- Only affects large websites: Any site with user-generated content can be vulnerable.
- Difficult to detect: While complex, automated tools can effectively identify vulnerabilities.