Wikis leave holes for cross-site scripting attacks

Michael Sutton, VP security research at Zscaler, claimed that so many sites now have vulnerabilities that could allow XSS attacks to happen and criminals will look for a site that has user supplied input accepted and created.

Sutton said: “Users are building a site and this is a very powerful ecosystem, a platform within itself. The users build it; the owners have the framework and got into the game early.

“Security pushes growth but too many of the sites are making the decision to not input security because they are so focussed on rapid growth. It has turned end-users into developers, what if one of the developers has malicious intentions?”

Sutton further claimed that XSS attacks are particularly dangerous as the vulnerability resides on the server, and the end-user is the victim, and ‘we are not seeing eradication because the guy who owns the site is not feeling the pain'.

In terms of detection and removal, Sutton claimed that the ideal solution is to buy Zscaler's XSS solution, but did state that he was ‘encouraged by IE8 as it is the first to have XSS detecting built in and protection' from an end-user perspective

“Being able to inspect traffic is very important, XSS is very easy to fix but you want to code to be consistent, as if you miss one page you are hit. I cannot attack a web application if I do not have input, everything is driven by the user but any input I can provide can be an attack version,” said Sutton.


See original article on scmagazineus.com