Spring XSS Protection Disabled

ID

java.spring_xss_protection_disabled

Severity

high

Resource

Misconfiguration

Language

Java

Tags

CWE:80, NIST.SP.800-53, OWASP:2021:A3, OWASP:2021:A5, PCI-DSS:6.5.7, spring

Description

Spring HTML escaping disabled.

Rationale

Cross-Site Scripting (XSS) is a significant security threat that occurs when applications include user input in web pages without proper validation or escaping, allowing attackers to insert malicious scripts.

In Spring MVC applications, misconfiguration or the absence of proper XSS protection can leave an application vulnerable.

A typical vulnerability scenario involves the improper handling of input received from web requests and presented back to users without escaping. Applications must configure view resolvers and other components to escape outputs properly.

Remediation

To effectively address XSS vulnerabilities in Spring MVC, Set the defaultHtmlEscape Context Parameter. This configuration ensures that by default, all model attributes in views are HTML-escaped, preventing script execution.

<web-app>
    ...
    <context-param>
        <param-name>defaultHtmlEscape</param-name>
        <param-value>true</param-value>
    </context-param>
    ...
</web-app>

Setting the defaultHtmlEscape to true provides a global setting that applies consistent HTML escaping across all views in your application, reducing the risk of XSS attacks by default.

References