Lab : Exploiting Stored XSS into Anchor `href` Attribute with Double Quotes HTML-Encoded 

Introduction: 

In this post, we’ll explore a Stored Cross-Site Scripting (XSS) vulnerability where malicious input is stored in a web application and later reflected in an anchor (`<a>`) tag’s `href` attribute. While double quotes (`”`) are HTML-encoded, the attacker can still inject a JavaScript URL to execute arbitrary code. We’ll break down the attack vector, exploitation steps, and mitigation strategies. 

Attack Vector:  

The vulnerability occurs when user-supplied input (e.g., a “Website” field in a comment form) is stored and later rendered inside an anchor tag’s `href` attribute. Although double quotes are encoded (preventing attribute escape), the attacker can abuse the `javascript:` protocol to execute malicious scripts.   

Example Payload: html: javascript:alert(1) 

This payload is injected into the `href` attribute, turning the anchor into a clickable element that triggers an alert. 

Exploitation Steps: 

1. Identify the Input Field: Post a comment with a random alphanumeric string (e.g., `Apexium1`) in the “Website” input field. 

2. Intercept the Request:   

1. Use Burp Suite to intercept the comment submission request.  

2. Send the request to Burp Repeater for manipulation. 

3. View the Stored Data:   

1. Make a second request in the browser to view the posted comment.  

2. Intercept this request with Burp Suite and send it to a new Repeater tab. 

3. Observe that the random string is reflected inside an anchor tag:  

Html: <a href=”Apexium123″>User’s Name</a> 

4. Inject the Payload:  

1. Repeat the process, but replace the random string with the payload:  

Html: javascript:alert(1) 

2. The rendered anchor tag becomes:  

Html: <a href=”javascript:alert(1)”>User’s Name</a> 

5. Verify the Exploit: 

1. Right-click the response in Burp Suite and select “Copy URL”.  

2. Paste the URL into a browser.  

3. Click the user’s name (the anchor tag) to trigger the `alert(1)` popup.  

Mitigation Strategies: 

1. Strict Input Validation: Reject or sanitize inputs containing the `javascript:` protocol or other dangerous patterns.  

2. Context-Aware Output Encoding: Encode user input based on the context (e.g., URL encoding for `href` attributes). 

3. Use Safe URL Schemes: Restrict the `href` attribute to safe schemes like `http://`, `https://`, or `mailto:`.  

4. Content Security Policy (CSP): Implement a CSP to block inline JavaScript and unauthorized scripts.  

5. Regular Security Testing: Conduct penetration testing and code reviews to identify and fix XSS vulnerabilities.   

Conclusion: 

Stored XSS in anchor `href` attributes, even with encoded double quotes, can lead to serious security risks. By understanding the attack vector and applying robust mitigation strategies, developers can protect their applications from such exploits. Always prioritize secure coding practices and proactive testing to safeguard user data.