Nginx Missing XSS Protection Vulnerability

漏洞信息

漏洞名称： Nginx Missing XSS Protection Vulnerability

漏洞类型： 跨站可执行脚本

漏洞等级： 高危

漏洞描述： 该漏洞涉及Nginx web服务器，Nginx是一个高性能的HTTP和反向代理服务器，广泛用于互联网服务中，包括大型网站和应用的后端服务。漏洞的核心在于Nginx配置中缺少对跨站脚本攻击（XSS）的保护措施，具体表现为未启用’X-XSS-Protection’ HTTP头。这一安全头的作用是启用浏览器的XSS过滤机制，从而防止反射型XSS攻击。技术原因在于Nginx的配置文件中未包含’add_header X-XSS-Protection “1; mode=block”‘指令，导致浏览器无法激活其内置的XSS防护功能。这种配置疏忽可能使得攻击者能够通过注入恶意脚本到网页中，进而窃取用户信息或执行其他恶意操作。由于Nginx的广泛应用，此漏洞的影响范围较广，攻击者无需认证即可利用此漏洞，增加了其危险性。

产品厂商： Nginx

产品名称： Nginx

来源： https://github.com/projectdiscovery/nuclei-templates/blob/804d1df949d5fbbfdee11564a2df65b6836a8d60/javascript%2Faudit%2Fwebserver%2Fnginx%2Fmissing-nginx-xss-protection.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: missing-nginx-xss-protection

info:
  name: Missing Nginx XSS Protection
  author: pussycat0x
  severity: high
  description: |
    Ensures that XSS protection is enabled in Nginx by checking for the 'X-XSS-Protection' header.
  reference:
    - https://wiki.devsecopsguides.com/docs/checklists/mongodb/
    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
  metadata:
    verified: true
  tags: audit,nginx,ssh,auth,hardening

javascript:
  - pre-condition: |
      isPortOpen(Host,Port);
    code: |
      var m = require("nuclei/ssh");
      var c = m.SSHClient();
      c.Connect(Host,Port,User,Pass);
      const NginxConfig = c.Run(Code)
      NginxConfig
      let result = "";
      if (NginxConfig.includes("http") && NginxConfig.includes("events") && !NginxConfig.includes("add_header X-XSS-Protection") && !NginxConfig.includes("mode=block")) {
      result += "Missing Nginx XSS protection";
      } else {
      exit();
      }
      result

    args:
      Host: "{{Host}}"
      Port: "22"
      User: "{{usernames}}"
      Pass: "{{passwords}}"
      Code: cat {{path}}

    payloads:
      path:
        - /etc/nginx/nginx.conf
        - /usr/local/etc/nginx/nginx.conf

    matchers:
      - type: dsl
        dsl:
          - "success == true"

    extractors:
      - type: dsl
        dsl:
          - response
# digest: 4a0a0047304502206f7ffac003e28ae5cb00bf27c5676f88a7721db088a1387f1318be12a667e378022100a7a2bad66a19f6c03a29aa2f4c93f3ca9d7d0c4757234cbb6ba4810bc20c89ac:922c64590222798bb761d5b6d8e72950