Forum Discussion
Solved
C# code causing XSS vulnerability
Hello,
We get a vulnerability scan that is show that one of my pages is susceptible to a XSS attack. We are using a telerik tree view to display different data when the nodes are expanded. This is the information they reported back to me.
Issue Detail
The value of the scrollPosition JSON parameter within the ctl00_ContentPlaceHolder1_VIndex2_tvIndex_ClientState parameter is copied into the HTML document as plain text between tags. The payload sbi7s<script>alert(1)</script>tx52l was submitted in the scrollPosition JSON parameter within the ctl00_ContentPlaceHolder1_VIndex2_tvIndex_ClientState parameter. This input was echoed unmodified in the application's response.
Request
older1_VIndex2_tvIndex_ClientState=%7b%22expandedNodes%22%3a[]%2c%22collapsedNodes%22%3a[]%2c%22logEntries%22%3a[]%2c%22selectedNodes%22%3a[]%2c%22checkedNodes%22%3a[]%2c%22scrollPosition%22%3a%220**sbi7s%3cscript%3ealert(1)%3c%5c%2fscript%3etx52l**%22%7d&ctl00_RadWindowManager1_ClientState=&__ASYNCPOST=true&ctl00%24ContentPlaceHolder1%24VIndex2%24btnAddCart=Add%20To%20Cart
Response
> HTTP/2 200 OK
> Cache-Control: no-cache
> Pragma: no-cache
> Content-Type: text/plain; charset=utf-8
> Expires: -1
> Server: Microsoft-IIS/10.0
> X-Powered-By: ASP.NET
> X-Frame-Options: SAMEORIGIN
> X-Ua-Compatible: IE=edge,IE=11,IE=10,IE=9,IE=8,IE=7
> Strict-Transport-Security: max-age=31536000
> Date: Wed, 19 Mar 2025 16:26:27 GMT
> Content-Length: 82
> 68|error|500|0**sbi7s<script>alert(1)</script>tx52l** is not a valid value for Int32.|
What is the best way to pinpoint this issue? How do I fix this so it isn't showing up on the scans?
sanitize input and encode output update telerik enable CSP and re run the security scan the prevent XSS
sanitize input and encode output update telerik enable CSP and re run the security scan the prevent XSS
Hi Jerry,
Thank you for your help. This has been one of the most frustrating problems. This site has been fine for many years and now our computing dept software is saying it's XSS vulnerable. This page has 1 tree view and many checkboxes per node. There is no other user input. On click on the tree I populate the next branch of data, is that considered the input? I'm going to work on enabling CSP for the telerik tree view and see if that will cure it. Thanks again
Hi Jerry,
I ended up contacting Telerik and they informed me that this issue is a false positive and that their controls are fine and that I should be OK going forward. You suggestion did help a lot, I was able to apply them to my site and the issue was still there. That made me realize that there has to be something else going on and that is when I reached out to Telerik.
Thank you
