Post

Evariste
@evaristegal0is.eurosky.social

I wanted to write a thread about this when CISA and FBI released an alert for this vulnerability class. I see at least two main issues about XSS: observability and good practices. The CISA's post didn't directly mention CSP in their recommendations, and CSP v3 is still not popular enough even if 1/👇

Evariste
@evaristegal0is.eurosky.social

it can help to mitigate the majority of common JS injections. Unlike TLS versions or the HSTS header, I don't remember reading questions about the CSP header in the security questionnaires I filled out. I have a feeling that we don't have visibility on XSS exploits because they could happen 2/👇

Evariste
@evaristegal0is.eurosky.social

on "mutable" software (e.g. websites), and vendors tend to release CVEs only for patchable software, not cloud software. In addition, vendors may not know about exploited XSS vulnerabilities, if they are not massively exploited because they may have a lack of observability, especially for 3/👇

Evariste
@evaristegal0is.eurosky.social

client-side XSS. So, if I had an XSS on a critical service, I would probably try to sell to the highest bidder - often they are not good guys - or use it on specific high-value targets, by making hardest the detection. So, all this thread to ask: is XSS underevaluated due to a lack of observability?