312-50 Question 299
Single answer▪ Web App ConceptsDuring a permitted web application assessment, you intercept the following HTTP request used by the application's search feature:\n\nGET /search?q=laptop HTTP/1.1\nHost: shop.example.com\n\nThe response reflects your input inside the page body. When you change the request to GET /search?q=%3Cscript%3Ealert(1)%3C/script%3E, the application returns the payload as <script>alert(1)</script> and no JavaScript executes. However, when you test GET /search?q=%22%20autofocus%20onfocus%3Dalert(1)%20x%3D%22, the payload appears inside an HTML input field value and the alert executes when the page loads. Which vulnerability best explains this behavior?
- A
Reflected cross-site scripting (XSS) caused by improper output encoding in an HTML attribute context
- B
Stored cross-site scripting (XSS) because the payload persists in the application's database
- C
SQL injection because special characters in the query string alter server-side database queries
- D
Cross-site request forgery (CSRF) because the browser automatically sends the victim's session cookie
Show answer and explanation
Correct answer: A
Explanation
This scenario demonstrates reflected XSS in an HTML attribute context. The application appears to apply output encoding suitable for HTML element body content when rendering <script> tags as <script>, but that same defense is insufficient when user input is inserted into an attribute value. In attribute context, failing to encode quotes and other dangerous characters can allow an attacker to terminate the attribute and inject new attributes or event handlers such as onfocus. CEH candidates should recognize that XSS depends heavily on where input is placed in the response: HTML body, attribute, JavaScript, CSS, and URL contexts each require different defensive handling. Best practices from OWASP's Cross Site Scripting Prevention Cheat Sheet emphasize context-aware output encoding, input validation where appropriate, and safer framework templating that automatically escapes data for the correct sink. This is not stored XSS because persistence is not shown, not SQL injection because the impact is browser-side code execution rather than database manipulation, and not CSRF because the issue is injection into the rendered page rather than forged authenticated requests.
- A. Correct.
Correct. The payload is supplied in the current request and immediately reflected in the response, which makes this reflected XSS rather than stored XSS. The key detail is context: the application safely encodes characters for HTML body text in one place, but fails to properly encode or validate untrusted data placed inside an HTML attribute value. Injecting a quote breaks out of the
valueattribute and adds a new event handler such asonfocus, leading to script execution. This is a classic output-encoding-by-context problem in web applications. - B. Incorrect.
Incorrect. Stored XSS requires the malicious payload to be saved by the application, such as in a database, comment field, profile, or message board, and then served to other users later. In this scenario, the payload is delivered in the search request and reflected immediately in the same response. There is no indication that the data is persisted.
- C. Incorrect.
Incorrect. SQL injection targets server-side query construction and typically affects database behavior, such as authentication bypass, data extraction, or query errors. Here, the observed effect is client-side JavaScript execution in the browser after the payload is inserted into the HTML response. That behavior is characteristic of XSS, not SQL injection.
- D. Incorrect.
Incorrect. CSRF involves tricking an authenticated user into sending an unintended state-changing request to a web application where the browser includes valid credentials automatically. This scenario focuses on untrusted input being reflected into HTML and executed in the browser, which is an XSS issue. The automatic inclusion of cookies is relevant to CSRF generally, but it does not explain the attribute injection and script execution shown here.