Cross site scripting (XSS) is a type of computer security exploit where information from one context, where it is not trusted, can be inserted into another context, where it is. From the trusted context, an attack can be launched.

A classic example of cross site scripting is to supply parameters to a CGI script on a web site which cause the web site to emit bogus data. For example, the use of HTML client-side scripting language fragments in a web page parameter may insert this information into the rendered page, resulting in targeted web browsers executing the code.

This may be done by entering data into a web form on the site, for example as part of a bulletin board feature, or by publicly posting a URL which users are likely to click on, for example in E-mails or Usenet.

Example 1:

1. UserA trusts example.com to run JavaScript on his machine.
2. UserB has found a way to inject/insert his own JavaScript code into example.com (for example into a bulletin board message) and inserts a malicious script that asks for people's credit card numbers and stores them somewhere where UserB can access them.
3. UserA visits example.com and UserB's script asks for his/her credit card number. Thinking that this is a legitimate request from example.com, UserA blissfully provides his credit card number.
4. UserB has effectively 'stolen' UserA's credit card number using Cross-site scripting and some social engineering.

Exampe 2:

1. UserA has an account at example.com and is logged in.
2. UserB injected a piece of JavaScript to retrieve the sessionid of the current user and send it to him.
3. UserA visits the manipulated page and his sessionid is transmitted to UserB.
4. UserB can now use UserA's account until he logs out.

If UserB had put the code on his own website, it would not be allowed to access the session-cookie.

The name "cross site" derives from the way the attack is directed "across" the web-site, from the attacking data source to the attacked browser.

Note: Cross site scripting is also sometimes abbreviated "CSS", but has nothing to do with the Cascading Style Sheets technology that is more commonly called CSS.

External links

• http://httpd.apache.org/info/css-security/
• http://www.cert.org/advisories/CA-2000-02.html
• XSS FAQ (http://www.cgisecurity.com/articles/xss-faq.shtml)
• http://www.shocking.com/~rsnake/xss.html

de:Cross-Site Scripting ja:クロスサイトスクリプティング