Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Burp Report analysis and solution

purushothaman | Last updated: Jul 16, 2021 04:40PM UTC

Hi folks, we have scanned our application live scan, we are getting below issues, Issue detail The value of the URL path filename is copied into the HTML document as plain text between tags. The payload mk2bv<script>alert(1)</script>h3vvy was submitted in the URL path filename. This input was echoed unmodified in the application's response. This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. Request GET /hbt/resources/assets/css/highcharts.cssmk2bv%3cscript%3ealert(1)%3c/script%3eh3vvy HTTP/1.1 Host: brm-qappprod01.cns-inc.com:9444 Cookie: JSESSIONID=0000o6-jGtQpr2O5DQphoah1UVa:-1 Upgrade-Insecure-Requests: 1 Accept: */* Accept-Language: en-US,en-GB;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 Connection: close Cache-Control: max-age=0 Accept-Encoding: gzip, deflate Response HTTP/1.1 404 Not Found X-Powered-By: Servlet/3.0 Content-Type: text/html; charset=US-ASCII $WSEP: Content-Language: en-US Content-Length: 373 Connection: Close Date: Tue, 08 Sep 2020 09:47:18 GMT <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=US-ASCII ...[SNIP]... <body> 404 Error: SRVE0190E: File not found: /resources/assets/css/highcharts.cssmk2bv<script>alert(1)</script>h3vvy </body> ...[SNIP]... my question is , since its shows file not found error in the response, do we required to address issue or we can submit false positive.

Uthman, PortSwigger Agent | Last updated: Jul 19, 2021 11:11AM UTC

Hi purushothaman, We do not offer consulting services, unfortunately, so you will need to liaise with your development team to see if this is a false positive. From the response, it looks like reflected XSS so you will want to see if the JavaScript itself is being executed. - https://portswigger.net/web-security/cross-site-scripting/reflected

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.