Stored DOM XSS
Stored DOM XSS (Stored Document Object Model Cross-Site Scripting) is a type of web application security vulnerability that allows attackers to inject and store malicious scripts in a web application, which are then executed in the victim’s browser when infected pages are loaded. This differs from other types of XSS, such as Reflected XSS and DOM-based XSS, because the malicious script is stored on the web application server and can affect all users viewing the infected content.
Stored DOM XSS Stages
Stored DOM XSS, the attack occurs in two stages:
Введення
The attacker sends malicious code (usually via an input form such as comments, forum posts, or user profile fields) to a website that does not sufficiently filter or screen the input. The web application stores this malicious code in its database or on the server without proper processing.
Execution
When another user visits a page containing the stored malicious script, their browser executes the script as part of the page’s DOM. This can lead to various unwanted consequences including stealing cookies, sessions, personal data, performing actions on behalf of the user and other attacks.
Приклади експлуатації
To better understand the Stored DOM XSS vulnerability, let’s take a look at one of the labs from PortSwigger, a well-known web security company. This lab demonstrates a Stored DOM XSS vulnerability in blog comment functionality. To solve this lab, exploit this vulnerability to call the alert() function.
Let’s start by exploring the functionality of comments.
As we can see we have 4 fields for entering information. Let’s enter something into them and capture the request using the burp tool.
As we can see the request is URL encoded, let’s try to insert this payload <><img src="1" onerror="alert(1)">, and then back to the post page with our commenter.
As we can see the vulnerability worked. Everyone who visits this page will see this alert.
Scanners that detect vulnerabilities
Burp Suite: One of the most popular web application AMAZON WEB SERVICES tools, Burp Suite offers advanced features for both automated and manual detection of vulnerabilities, including Stored DOM XSS.
OWASP ZAP (Zed Attack Proxy): A free, open-source tool from OWASP designed to find vulnerabilities in web applications. ZAP can be used for automated scanning and also provides features for manual testing.
Acunetix: A powerful commercial web application scanner capable of detecting a wide range of vulnerabilities, including Stored DOM XSS. Acunetix uses advanced technologies for analyzing and finding vulnerabilities.
Veracode: platform offers automated tools for finding and fixing vulnerabilities in code, including Stored DOM XSS vulnerabilities, as part of the software development process.
Detectify: This cloud-based web application security scanner leverages technologies developed by cybersecurity experts to detect vulnerabilities, including Stored DOM XSS, and provides detailed reports and recommendations for remediation.
Netsparker: Another commercial web security scanner that detects vulnerabilities, including Stored DOM XSS, in web applications and web services, providing accurate results with minimal false positives.
Average CVSS score for Stored DOM XSS
The Common Vulnerability Scoring System (CVSS) score for a vulnerability like Stored DOM XSS can vary widely based on the specific circumstances of each vulnerability, such as the complexity of the exploit, the required privileges, the level of user interaction, and the impact on confidentiality, integrity, and availability. CVSS scores range from 0 to 10, with 10 being the most severe.
Stored DOM XSS vulnerabilities can have a broad range of impacts, from minor to critical, depending on how they can be exploited and what data or systems can be compromised as a result. Generally, XSS vulnerabilities tend to have a moderate to high CVSS score, often falling in the range of 4.0 to 8.9, depending on the factors mentioned above.
For a precise CVSS score for a specific Stored DOM XSS vulnerability, one would need to analyze the particular vulnerability details and use the CVSS scoring calculator, taking into account the various metrics such as Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, and Availability.
To study Stored DOM XSS
1. Understand the Basics of XSS
Start with understanding Cross-Site Scripting (XSS) vulnerabilities in general, including the different types: Reflected XSS, Stored XSS, and DOM-Based XSS.
Understand the specific characteristics that differentiate Stored DOM XSS from other types, focusing on how the malicious script is stored and executed within the DOM of the webpage.
2. Explore Stored DOM XSS Concepts
Gain a solid understanding of the Document Object Model (DOM) as it’s crucial for understanding how Stored DOM XSS attacks manipulate web pages.
Learn how attackers exploit Stored DOM XSS vulnerabilities, including the process of injecting malicious scripts, how those scripts are stored, and how they’re executed by the victim’s browser.
3. Practical Learning
Engage with interactive labs and platforms like Академія веб - безпеки PortSwigger, OWASP WebGoat, or Hack The Box, which offer practical exercises on XSS, including Stored DOM XSS.
Study documented cases of Stored DOM XSS vulnerabilities from CVE databases or security advisories to understand how they were exploited and fixed.
4. Defensive Programming
Understand how to prevent Stored DOM XSS attacks through secure coding practices, input validation, output encoding, and the use of Content Security Policy (CSP).
Familiarize yourself with security tools and scanners that can help identify potential XSS vulnerabilities in web applications.
5. Hands-On Practice
Create simple web applications and try to exploit Stored DOM XSS vulnerabilities in a controlled environment. Then, practice securing these applications.
If possible, contribute to open-source projects or participate in bug bounty programs to gain real-world experience in identifying and mitigating vulnerabilities.
How to be protected from Stored DOM XSS
• Ensure all user inputs are validated on both the client and server sides. Use allowlists for validation to accept only known safe inputs.
• Sanitize user inputs to prevent malicious data from being processed or stored.
• Utilize modern web frameworks and libraries that automatically escape user input. Frameworks like React, Angular, and Vue.js have built-in XSS protections.
• Use CSP as an additional security layer to detect and mitigate certain types of attacks, including XSS. CSP can restrict the resources that a browser is allowed to load, preventing the execution of unauthorized scripts.
• Implement secure session management using HTTPOnly and Secure flags in cookies to protect session tokens and other sensitive data from client-side script access.
• Conduct regular audits of your web applications for vulnerabilities. Utilize automated vulnerability scanners and static CODE ANALYSIS tools to detect potential Stored DOM XSS vulnerabilities.
Висновок
Stored DOM XSS vulnerabilities represent a critical risk to the security web applications by enabling attackers to inject and execute malicious scripts within the victim’s browser. This article has delved into the intricacies of Stored DOM XSS vulnerabilities, examining how they arise, their potential consequences for web applications, and the various methods to mitigate their exploitation.
To effectively safeguard against Stored DOM XSS attacks, a comprehensive security strategy is essential. This strategy should encompass diligent input validation and sanitization, the employment of secure coding practices, and the adoption of modern web frameworks that inherently mitigate XSS risks. Additionally, the implementation of Content Security Policies (CSP) can provide an extra layer of defense by restricting the types of content that can be executed within the web application.
Moreover, continuous education and training for developers on secure coding practices, alongside regular security assessments and updates to web application components, are pivotal in preempting the exploitation of such vulnerabilities. The deployment of security tools and scanners to routinely identify and rectify vulnerabilities also plays a vital role in maintaining the security integrity of web applications.
By placing a strong emphasis on security and incorporating proactive security measures, organizations can effectively reduce the threat posed by Stored DOM XSS vulnerabilities. It is crucial for developers, security experts, and organizations to remain alert and informed about the latest security trends and best practices in web application security. This vigilance is key to defending against the sophisticated and evolving landscape of cyber threats, including Stored DOM XSS vulnerabilities.
Інші Послуги
Insomnia Security Scanner
AI-powered web application security scanner by CQR. Automated vulnerability discovery, exploit verification, and detailed reporting for modern applications.
Дізнатися більше
Захист інфраструктури CRYEYE
Аудит безпеки за допомогою CryEye забезпечує інформаційну безпеку підприємства, захищаючи всю інфраструктуру.
Дізнатися більше Тестування на проникнення
Знайдіть вразливості у всій інфраструктурі вашого бізнесу раніше, ніж це зроблять хакери! У межах консалтингу з тестування на проникнення ми підберемо методи пентестів та інші індивідуальні рекомендації з кібербезпеки для вашого бізнесу.
Дізнатися більше Соціальна Інженерія
Simulate real-world phishing, vishing, and pretexting attacks to measure and improve your team's security awareness and response capabilities.
Дізнатися більше Тестування Продуктивності
Усі види тестування навантаження і продуктивності вашої системи від компанії CQR, що спеціалізується на онлайн-безпеці.
Дізнатися більше AI-Powered Vulnerability Assessment
Leverage artificial intelligence to discover, prioritize, and remediate vulnerabilities across your digital assets faster and more accurately than traditional scanners.
Дізнатися більше Cloud Security Audit (AWS / GCP / Azure)
Comprehensive security review of your cloud environments — IAM policies, network controls, data exposure, and misconfigurations across all major cloud platforms.
Дізнатися більше DevSecOps Integration
Embed security into every stage of your CI/CD pipeline. Automated SAST, DAST, SCA, and secret scanning so vulnerabilities are caught before they reach production.
Дізнатися більше API Security Testing
In-depth testing of REST, GraphQL, and SOAP APIs for authentication flaws, authorization bypasses, injection vulnerabilities, and data leakage risks.
Дізнатися більше Mobile Application Penetration Testing
Manual and automated security testing for iOS and Android applications — reverse engineering, runtime analysis, traffic interception, and backend API assessment.
Дізнатися більше IoT Security Assessment
Evaluate firmware, communication protocols, cloud backends, and physical interfaces of IoT devices to identify vulnerabilities before attackers do.
Дізнатися більше Blockchain & Smart Contract Audit
Formal verification and manual code review of smart contracts on Ethereum, Solana, and other chains. Detect reentrancy, overflow, and logic flaws before deployment.
Дізнатися більше Red Team Operations
Advanced adversary simulation using real attacker TTPs (MITRE ATT&CK) to test your detection, response, and overall security posture under realistic conditions.
Дізнатися більше Threat Intelligence & Monitoring
Continuous monitoring of threat feeds, dark web, and attacker infrastructure to provide actionable intelligence specific to your organization and industry.
Дізнатися більше Zero Trust Architecture Review
Assess and design your Zero Trust security model — identity verification, micro-segmentation, least-privilege access, and continuous validation controls.
Дізнатися більше Compliance Consulting (PCI DSS / SOC 2 / GDPR)
Expert guidance to achieve and maintain compliance with major security frameworks. Gap analysis, remediation roadmaps, and audit-readiness support.
Дізнатися більше Dark Web Monitoring
Continuous surveillance of dark web forums, marketplaces, and breach databases for leaked credentials, sensitive data, or mentions of your organization.
Дізнатися більше Phishing Simulation & Awareness Training
Controlled phishing campaigns combined with interactive security awareness training to build a human firewall across your entire organization.
Дізнатися більше Supply Chain Security Audit
Assess third-party vendor risks, open-source dependencies, and software supply chain integrity to prevent attacks like SolarWinds and Log4Shell.
Дізнатися більше Container & Kubernetes Security
Security review of Docker images, Kubernetes clusters, RBAC policies, network policies, and runtime configurations to harden your container infrastructure.
Дізнатися більше Web Application Firewall (WAF) Deployment
Professional WAF setup, rule tuning, and ongoing management to block SQL injection, XSS, CSRF, and other OWASP Top 10 threats in real time.
Дізнатися більше Bug Bounty Program Management
Full lifecycle management of your bug bounty program — scope definition, researcher coordination, triage, validation, and remediation tracking.
Дізнатися більше OSINT Investigation Services
Open-source intelligence gathering on individuals, organizations, and infrastructure. Ideal for pre-engagement recon, fraud investigation, and competitive analysis.
Дізнатися більше Digital Forensics & Incident Response
Rapid response to security breaches — evidence collection, malware analysis, attacker timeline reconstruction, and actionable remediation recommendations.
Дізнатися більше