CAPEC-591: Reflected XSS
Description
This type of attack is a form of Cross-Site Scripting (XSS) where a malicious script is reflected off a vulnerable web application and then executed by a victim's browser. The process starts with an adversary delivering a malicious script to a victim and convincing the victim to send the script to the vulnerable web application.
- Likelihood of attack
- High
- Typical severity
- Very High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Inject Unexpected Items
Prerequisites
- An application that leverages a client-side web browser with scripting enabled.
- An application that fail to adequately sanitize or encode untrusted input.
Skills required
- MediumRequires the ability to write malicious scripts and embed them into HTTP requests.
Consequences
- Confidentiality
Read Data
A successful Reflected XSS attack can enable an adversary to exfiltrate sensitive information from the application.
- ConfidentialityAuthorizationAccess Control
Gain Privileges
A successful Reflected XSS attack can enable an adversary to elevate their privilege level and access functionality they should not otherwise be allowed to access.
- ConfidentialityIntegrityAvailability
Execute Unauthorized Commands
A successful Reflected attack can enable an adversary run arbitrary code of their choosing, thus enabling a complete compromise of the application.
- Integrity
Modify Data
A successful Reflected attack can allow an adversary to tamper with application data.
Mitigations
- Use browser technologies that do not allow client-side scripting.
- Utilize strict type, character, and encoding enforcement.
- Ensure that all user-supplied input is validated before use.
Related weaknesses (CWE)
Related attack patterns
Parent
More specific patterns
- CAPEC-18XSS Targeting Non-Script ElementsDetailed
- CAPEC-32XSS Through HTTP Query StringsDetailed
- CAPEC-86XSS Through HTTP HeadersDetailed
- CAPEC-198XSS Targeting Error PagesDetailed
- CAPEC-199XSS Using Alternate SyntaxDetailed
- CAPEC-243XSS Targeting HTML AttributesDetailed
- CAPEC-244XSS Targeting URI PlaceholdersDetailed
- CAPEC-245XSS Using Doubled CharactersDetailed
- CAPEC-247XSS Using Invalid CharactersDetailed