CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Description

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into trusted web sites. Cross-Site Scripting attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Once the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker can transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker can send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site.

XSS attacks can generally be categorized into two categories: stored and reflected.

Stored attacks are those where the injected script is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information.

Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request. Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other web site. When a user is tricked into clicking on a malicious link, or even just browsing to a malicious site, the injected code travels to the vulnerable web site, which reflects the attack back to the user’s browser. The browser then executes the code because it came from a "trusted" server. 

Weakness consequences include disclosure or stealing of information stored in user's cookies and putting confidentiality at risk by installing Trojan hourse programs or other malicious software.

The vulnerability is introduced during Architecture and Design, Implementation stages.

Latest vulnerabilities for CWE-79

References

Description of CWE-79 on Mitre website