The attacker inserts invalid characters in identifiers to bypass
application filtering of input. Filters may not scan beyond invalid
characters but during later stages of processing content that follows these
invalid characters may still be processed. This allows the attacker to sneak
prohibited commands past filters and perform normally prohibited operations.
Invalid characters may include null, carriage return, line feed or tab in an
identifier. Successful bypassing of the filter can result in a XSS attack,
resulting in the disclosure of web cookies or possibly other results.
Attack Prerequisites
The target must fail to remove invalid characters from input and fail to
adequately scan beyond these characters.
Resources Required
No special resources are required.
Solutions and Mitigations
Design: Use libraries and templates that minimize unfiltered input.
Implementation: Normalize, filter and white list any input that will be
included in any subsequent web pages or back end operations.
Implementation: The victim should configure the browser to minimize active
content from untrusted sources.
Description
