WSO2 0-day Cross-Site Scripting Attack

As defined by the Open Worldwide Application Security Project (OWASP):

‘Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user’.

https://owasp.org/www-community/attacks/xss/

To summarize, XSS attacks occur when an attacker submits input that a website does not handle properly. For example, script tags submitted are incorporated into the page structure and treated as actual code, instead of being displayed as a literal string.

Reflected XSS occurs when you can transmit this malicious input to a victim using a hyperlink (or some other type of poisoned content). Then you get them to visit the link using social engineering techniques.

When someone clicks the link, the malicious JavaScript is executed in the context of their browser. This allows an attacker to steal cookies (leading to impersonation and unauthorized access).

Other possible exploits include, a redirect to a different malicious site, or “keylog” any actions taken on that same page.

These types of attacks are usually the result of a lack of input sanitization. Malicious and/or unexpected characters are filtered from input, an no HTML encoding is performed when that untrusted input is subsequently displayed, allowing script to be loaded in an executable format.