QID 153004

XSS vulnerabilities occur when the Web application echoes user-supplied data in an HTML response sent to the Web browser. For example, a Web application might include the user's name as part of a welcome message, or display a home address when confirming a shipping destination. If the user-supplied data contains characters that are interpreted as part of an HTML element instead of literal text, then an attacker can modify the HTML that is received by the victim's Web browser.

The XSS payload persists within one or more Web pages after it has been injected into the Web application by an attacker. An XSS payload may consist of HTML, JavaScript or other content that will be rendered by the browser. This exposes any user who views the vulnerable page to attack, and exploits the expectation of trust that the victim has in the Web application.

The malicious content of the XSS payload remains in the Web application after it has been submitted. Any user who visits the vulnerable page will be affected by the attack. The victim does not have to click on a suspicious link or otherwise receive malicious content from the attacker.

XSS exploits pose a significant threat to a Web application, its users and user data. XSS exploits target the users of a Web application rather than the Web application itself. An exploit can lead to theft of the user's credentials and personal or financial information. Complex exploits and attack scenarios are possible via XSS because it enables an attacker to execute dynamic code. Consequently, any capability or feature available to the Web browser (for example HTML, JavaScript, Flash and Java applets) can be used as part of a compromise.