HCSV #003 - Cross-Site Scripting (XSS)

This paper goes over the Hydraulisc-Centric Security Vulnerability No.3 (HCSV #003)

HCSV #003, titled "Cross-Site Scripting (XSS)", was a critical issue involving a lack of server-side input sanitization, leading to potential Cross-Site Scripting (XSS) vulnerabilities. This affected all Hydraulisc-powered platforms that utilized user-generated content.

This was a MAJOR Security Vulnerability, which has been patched.

Skip to

• Explanation: What is HCSV #003
• HCSV #003 Solution
• Technical Spreadsheet

HCSV #003 - An in-depth explanation

The missing backend HTML cleansing function allowed malicious actors to inject scripts via user input fields, leading to potential XSS attacks. Although frontend sanitization was in place, backend validation was not enforced, leaving a gap in the security measures in place.

This issue persisted until the vulnerability was identified and promptly addressed through proper input validation and sanitization mechanisms on the backend.

Attackers could potentially use this vulnerability to inject harmful JavaScript code into web pages viewed by other users, leading to unauthorized actions within the application.

The issue affected any Hydraulisc platform that relied on unvalidated user inputs, making it critical to implement the fix across all relevant platforms.

HCSV #003 - What has been done

Please note, the team at Hydraulisc-Centric Security Vulnerability have agreed that this Security Vulnerability is no longer reproducible.

• Implemented server-side HTML sanitization using the linkify and DOMPurify libraries, and a custom detection and prevention algorithm.

The backend now checks all user inputs to remove any special characters which could possibly lead to the injection of malicious scripts, and replace them with their HTML Character Entity counterparts so that no malicious scripts can be injected.

• Revised backend logic to perform checks on all data inputs received via API endpoints.

This security measure ensures that inputs bypassing the frontend still undergo proper sanitization.

Technical Spreadsheet

Guide: Severity Numbers. Lower is better. Maximum value of 20, lowest of 1.