Term:cross-site scripting [XSS]

Cross-site scripting (often abbreviated XSS) is an imprecise term for a number of different web-server vulnerabilities. To over-simplify, malicious software of some sort – usually written using JavaScript – can be placed on the server through otherwise normal usage. That malicious code can then attack subsequent visitors who simply visit the service or page.

This type of vulnerability is normally prevented by the server. Most do, indeed, prevent this type of malicious code placement. Others, however, don’t, or do so incompletely or incorrectly. These are referred to as having “cross-site scripting vulnerabilities”, or “XSS vulnerabilities”.

One example of such vulnerabilities is malicious instructions in a comment on a blog post. Once published, subsequent visitors to the page could be at risk of the malicious code being executed in their browsers as the comment is displayed. A properly secure server would not allow those instructions to be included, or would only include them in a way that would not work.

Typically, malicious code of this form is a very short reference to more code stored elsewhere on another server – hence the “cross site” reference. Posting a malicious comment on a vulnerable site might cause every subsequent visitor to run code from a completely different site.

Note that while I’ve used blog post comments here as an example, commenting systems on major platforms are typically robust and not vulnerable. The risks of cross-site scripting vulnerabilities can apply to any type of site or service that allows user interaction.

Cross-site scripting (XSS) is a type of security vulnerability typically found in web applications. XSS attacks enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy. Cross-site scripting carried out on websites accounted for roughly 84% of all security vulnerabilities documented by Symantec up until 2007. XSS effects vary in range from petty nuisance to significant security risk, depending on the sensitivity of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner network.

« Back to Glossary Index