Xss Cross Site Scripting on Aws
How XSS Cross-Site Scripting Manifests in AWS
XSS vulnerabilities in AWS applications typically emerge through Lambda functions, API Gateway integrations, and serverless frontends. A common pattern involves user input passed through API Gateway to Lambda functions without proper sanitization, then reflected back in HTML responses or stored in DynamoDB for later retrieval.
Consider a Lambda function handling form submissions:
exports.handler = async (event) => {
const userInput = event.queryStringParameters.userInput;
// Vulnerable: direct reflection without sanitization
return {
statusCode: 200,
body: `<html><body>Hello ${userInput}</body></html>`
};
};
When deployed behind API Gateway, this creates a classic reflected XSS vector. An attacker could craft a URL like:
https://your-api-gateway-endpoint?userInput=<script>alert('XSS')</script>Stored XSS becomes particularly dangerous in AWS when user input is saved to DynamoDB or S3 and later rendered in admin dashboards. For example, a blog comment system might store unsanitized HTML:
const AWS = require('aws-sdk');
const dynamodb = new AWS.DynamoDB.DocumentClient();
exports.handler = async (event) => {
const comment = event.body.comment;
await dynamodb.put({
TableName: 'comments',
Item: { id: Date.now(), comment }
}).promise();
return { statusCode: 200, body: 'Comment saved' };
};
The admin panel that displays these comments becomes a stored XSS vector, especially problematic in multi-tenant SaaS applications running on AWS.
AWS-Specific Detection
Detecting XSS in AWS environments requires understanding the serverless architecture and common attack surfaces. middleBrick's black-box scanning approach is particularly effective for AWS APIs because it tests the actual runtime behavior without needing source code access.
When scanning an AWS API Gateway endpoint, middleBrick performs 12 parallel security checks including XSS-specific tests:
middlebrick scan https://your-api-gateway-endpoint.amazonaws.com/prod
The scanner tests for reflected XSS by injecting payloads like:
- <script>alert(1)</script>
- <img src=x onerror=alert(1)>
- <iframe src=javascript:alert(1)>
For stored XSS detection, middleBrick's API analysis includes checking for endpoints that accept HTML content and lack Content Security Policy headers. The scanner also examines OpenAPI specifications to identify parameters that might accept HTML or script content.
Key AWS-specific indicators of XSS risk include:
| Indicator | Why It Matters |
|---|---|
| API Gateway endpoints returning HTML | Direct reflection vectors |
| Lambda functions using res.send without sanitization | Express-style responses in serverless |
| DynamoDB tables storing user content | Stored XSS potential |
| S3 static sites without CSP headers | Client-side XSS protection missing |
middleBrick's LLM security checks are particularly relevant for AWS applications using AI/ML services. The scanner tests for system prompt leakage and prompt injection vulnerabilities in endpoints that integrate with Amazon Bedrock or other LLM services.
AWS-Specific Remediation
Securing AWS applications against XSS requires a defense-in-depth approach using AWS-native tools and best practices. The most effective strategy combines input validation, output encoding, and security headers.
For input validation in Lambda functions, use AWS's native capabilities:
const AWS = require('aws-sdk');
const { escape } = require('lodash');
exports.handler = async (event) => {
const userInput = event.queryStringParameters.userInput || '';
// Input validation: allow only expected characters
if (!/^[a-zA-Z0-9\s.,-]*$/.test(userInput)) {
return {
statusCode: 400,
body: 'Invalid input'
};
}
// Output encoding before reflection
const safeOutput = escape(userInput);
return {
statusCode: 200,
body: `<html><body>Hello ${safeOutput}</body></html>`
};
};
For stored XSS prevention in DynamoDB, implement content sanitization:
const AWS = require('aws-sdk');
const sanitizeHtml = require('sanitize-html');
const dynamodb = new AWS.DynamoDB.DocumentClient();
exports.handler = async (event) => {
const comment = event.body.comment;
// Sanitize HTML content before storage
const cleanComment = sanitizeHtml(comment, {
allowedTags: ['b', 'i', 'u', 'strong', 'em'],
allowedAttributes: {}
});
await dynamodb.put({
TableName: 'comments',
Item: { id: Date.now(), comment: cleanComment }
}).promise();
return { statusCode: 200, body: 'Comment saved' };
};
Enhance security with API Gateway custom authorizers that validate input schemas before reaching your Lambda functions. Use AWS WAF to block common XSS patterns at the edge:
{
"Rules": [
{
"Name": "XSSProtection",
"Priority": 1,
"Action": { "Block": {} },
"VisibilityConfig": { "SampledRequestsPerRule": 1000 },
"Statement": {
"SqliMatchStatement": {
"FieldToMatch": { "QueryString": {} },
"TextTransformations": [{"Id": "Lowercase","Priority": 1,"Type": "LOWERCASE"}]
}
}
}
]
}
For React applications deployed on AWS S3/CloudFront, implement Content Security Policy headers through CloudFront functions:
exports.handler = async (event) => {
const request = event.Records[0].cf.request;
if (request.method === 'GET') {
request.headers['x-content-security-policy'] = [
{
key: 'x-content-security-policy',
value: "default-src 'self'; script-src 'self' 'nonce-XYZ123'"
}
];
}
return request;
};
Integrate middleBrick's CLI into your CI/CD pipeline to catch XSS regressions before deployment:
name: Security Scan
on: [pull_request]
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- run: npm install -g middlebrick
- run: middlebrick scan https://staging-api.yourdomain.com --fail-below B
env:
MIDDLEBRICK_API_KEY: ${{ secrets.MIDDLEBRICK_API_KEY }}
Related CWEs: inputValidation
| CWE ID | Name | Severity |
|---|---|---|
| CWE-20 | Improper Input Validation | HIGH |
| CWE-22 | Path Traversal | HIGH |
| CWE-74 | Injection | CRITICAL |
| CWE-77 | Command Injection | CRITICAL |
| CWE-78 | OS Command Injection | CRITICAL |
| CWE-79 | Cross-site Scripting (XSS) | HIGH |
| CWE-89 | SQL Injection | CRITICAL |
| CWE-90 | LDAP Injection | HIGH |
| CWE-91 | XML Injection | HIGH |
| CWE-94 | Code Injection | CRITICAL |