At a SaaS company, a comment field stores a script, and that script runs later in the browsers of other users who open the same comment. Which attack is this?
Select an answer to reveal the explanation.
Short Explanation
Think of a sticky note on a shared board that can affect everyone who reads it later. You stored a script in a comment, and other users’ browsers execute it when they open that comment: stored cross-site scripting. The other descriptions involve changing a database query, running a server shell command, or downgrading a transport session.
Full Explanation
Cross-site scripting puts attacker-controlled script where a browser will execute it in a user’s session. Saving the script in a comment and having it run later for other readers is stored cross-site scripting: the payload waits on the server and then runs in each later browser. A script stored in the comment and executed later in the browsers of other people who read it describes that behavior. A change to the database query behind the comment so the application returns or alters extra rows would be SQL injection; the scenario instead involves script execution in browsers, not a changed query. A command run by the application server shell that lists directories for the person who posted the comment would be command injection on the server; here, the script runs in other users’ browsers. A forced move to an older transport version while a reader negotiates a protected session to the site is a handshake downgrade, and it does not store a script in a comment. On the exam, stored and reflected cross-site scripting differ in timing, but both are cross-site scripting rather than SQL injection or a shell command. In operations, view the stored comment as another user and confirm the script executes in that browser, then remove the stored content.