Cross Site Scripting with Hidden Inputs

Question

My company gave me the task of resolving all security issues with a particular application. The security tream reported a cross site scripting error. The error lies in the following input field:

<input type="hidden" name="eventId" value="${param.eventId}"/>

The report from security wasn't very detailed, but the say they can make a POST request to the page that has the above tag including the following malicious code:

eventId=%22%3e%3csCrIpT%3ealert(83676)%3c%2fsCrIpT%3e

And that when the page reloads, it will have the following:

<input type="hidden" name="eventId" value=""><sCrIpt>alert(83676)</sCrIpt></value>

I am trying to "be the hacker" and show the vulnerability. But I can't figure out how they manage to get that script in there. I am guessing they include it as a URL parameter in the GET request for the form, but when I try to do it myself I get a 403 error. Does anyone know how the vulnerability can be shown?

I know there is a number of XSS questions on the site, but none seem to hit this topic.

Solution 1

So, I am not sure why, but my original hunch was correct. The script can be put on as a URL parameter. For some reason though, this was not working with our staging site. Only with running the application locally. I am not sure why, but this works (only locally):

http://localhost:8080/myUrl/MyAction.do?eventId=%22%3e%3csCrIpT%3ealert(83676)%3c%2fsCrIpT%3e

Doing that, you see an alert box pop up. I am planning to fix it using JSTL functions.

<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn" %>
...
<input type="hidden" name="eventId" value="${fn:escapeXml(param.eventId)}"/>

Solution 2

Install [TamperData][1] add-on in firefox browser which let you edit the data before submitting. Doesn't matter if it's in POST or GET.

By using this hidden fields can be edited.