Poisoned Pipeline / Techniques / T0119
Cross-site scripting
Cross-site scripting (XSS) is a web security vulnerability that allows an attacker to compromise the interactions that users have with a vulnerable applications.
XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.
An attacker can use XSS to send a malicious script to an unsuspecting user.
The end user browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.
These scripts can even rewrite the content of the HTML page.
Where this idea came from
Recorded from defender guidance (OWASP, NIST, SLSA, CISA, or vendor secure-development docs) as an attacker-side behavior.
- https://owasp.org/www-community/attacks/xss/
- https://www.splunk.com/en_us/blog/learn/cross-site-scripting-xss-attacks.html
- https://portswigger.net/web-security/cross-site-scripting
Mitigations
- M1190 Use framework security mechanisms
- M1191 Escape all user supplied input
- M1192 Encode data output
- M1193 Use HTML sanitization
- M1194 Use content security policy
- M1883 Implement Web Application Firewall
Detections
- D1170 Configure application audit logs to detect injection attacks
- D1171 Implement Web Application Firewall
Observed in incidents (3)
- Packagist CMS themes delivering iOS spyware
- VHX Harvester panel ran npm typosquat recon into a vast.ai GPU-cloud intrusion
- Brevo Cloudflare Worker ClickFix