Are you responsible for the security of your company’s web applications?

What are the steps usually taken when it comes to removing vulnerabilities from web applications and websites?

Many IT managers rely on a web application security scan to help identify anomalies, this being the first step towards vulnerability removal.

Not having enough time and budget forces many IT managers to choose between vulnerabilities, i.e. try to fix highest priority risks first.

This is where the real problem begins.

SQL Injection is often given precedence over other vulnerabilities especially cross-site scripting. In fact, many in the web application security industry think XSS vulnerability isn’t as dangerous for web applications and websites, and can be identified and fixed last.

XSS Vulnerability – Why Do You Think It Is Not a Dangerous Vulnerability?

In XSS vulnerability, the victim of an attack isn’t the actual web application, web server, or data stored in a database but the user/visitor. What does this mean? If a forum or WordPress blog post is injected by XSS vulnerability, the hacker will only gain access to the private messages, forum posts, and user’s profile. Such a hack attack won’t give access to sensitive data (credit card numbers, customer details) that can be stolen or enable the hacker to tamper the web application.

What Can An Attacker Actually Do With XSS Vulnerability?

Malicious scripts are injected by hackers into an otherwise trusted website, in a cross-site site (XSS) attack. This vulnerability can then be exploited by the attacker in the form of a malicious code (usually a browser side script) that is sent to a different user of the same web application.

Web developers and company’s in-house IT specialists think XSS vulnerability is relatively harmless and can be placed as the lowest priority. In reality, cross-site scripting can do some serious damage:

l Bypass restriction in websites
l Malware attack
l Steal identity and confidential data
l Denial of service attacks
l Website defacement
l Session hijacking

In the end, no vulnerability should be considered low priority. If possible, all should be identified and fixed within a reasonable timeframe so that end-users and customers don’t suffer.

It is also a good idea to undergo monthly web application security scanning and assessment by a reliable managed service provider. Lean Security is always ready for the test! Try our free trial today.