HTML Injection vulnerability is a kind of injection vulnerability as you can understand from it’s name. It allows the user to inject his/her arbitrary HTML codes to the webpage. Injection type may be stored or reflected. It looks like a Cross-site Scripting (XSS) vulnerability. Some researchers consider the HTML Injection vulnerability to be a sub-part of XSS.
HTML (Hypertext Markup Language) is the cornerstone of websites. JavaScript and CSS body of websites. How can threat actors use HTML to fool people?
Threat actors can create fake web pages via using HTML Injection vulnerability. They can manipulate a trustful but vulnerable website against HTML Injection. They can create a fake webpage by using stored HTML Injection or they achieve XSS. After achieving XSS threat actors can steal cookies, hijack accounts, steal credentials and other sensitive information.
HTML Injection vulnerability allows the user to modify the web page and that probably would have a bad influence on brand reputation. Your customers may think you don’t take necessary security measures and apply best practices.
HTML Injection detection is not very hard. You can detect HTML Injection vulnerabilities by checking your input fields. If the web page renders your query as an HTML code, bingo! You find an HTML injection vulnerability.
Please consider that you have a web page which comes after a search query:
<html>
<h1>Results of your search query: </h1>
<h2>{your_query}</h2>
<ol>
<li>Result A</li>
</ol>
</html>
As you can see in the above code, if there is no any mitigation your web page renders this query as an HTML code. If you query for “<a href=”attackersite.com”> HACKED!! </a>”, you will see a web page which contains a clickable link in H2 tags.
First of all, you should apply best practices according to your web server. Then:
