Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Burp Report analysis and solution

purushothaman | Last updated: Jul 16, 2021 04:40PM UTC

Hi folks, we have scanned our application live scan, we are getting below issues, Issue detail The value of the URL path filename is copied into the HTML document as plain text between tags. The payload mk2bv<script>alert(1)</script>h3vvy was submitted in the URL path filename. This input was echoed unmodified in the application's response. This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. Request GET /hbt/resources/assets/css/highcharts.cssmk2bv%3cscript%3ealert(1)%3c/script%3eh3vvy HTTP/1.1 Host: brm-qappprod01.cns-inc.com:9444 Cookie: JSESSIONID=0000o6-jGtQpr2O5DQphoah1UVa:-1 Upgrade-Insecure-Requests: 1 Accept: */* Accept-Language: en-US,en-GB;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 Connection: close Cache-Control: max-age=0 Accept-Encoding: gzip, deflate Response HTTP/1.1 404 Not Found X-Powered-By: Servlet/3.0 Content-Type: text/html; charset=US-ASCII $WSEP: Content-Language: en-US Content-Length: 373 Connection: Close Date: Tue, 08 Sep 2020 09:47:18 GMT <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=US-ASCII ...[SNIP]... <body> 404 Error: SRVE0190E: File not found: /resources/assets/css/highcharts.cssmk2bv<script>alert(1)</script>h3vvy </body> ...[SNIP]... my question is , since its shows file not found error in the response, do we required to address issue or we can submit false positive.

Uthman, PortSwigger Agent | Last updated: Jul 19, 2021 11:11AM UTC