Improper Neutralization of Alternate XSS Syntax

Description

Improper Neutralization of Alternate XSS Syntax is a variant of Cross-site Scripting (XSS) that occurs when software attempts to filter XSS attacks but fails to account for alternate syntax, encoding schemes, or lesser-known attack vectors that achieve the same malicious outcome. Attackers bypass security filters using techniques such as HTML entity encoding (<script>), URL encoding (%3Cscript%3E), Unicode variants, null bytes, malformed tags, CSS-based injection, SVG scripts, or browser-specific parsing quirks. This vulnerability highlights the difficulty of implementing effective XSS prevention through blacklist-based filtering, as the number of bypass techniques constantly evolves.

Risk

This weakness demonstrates why blacklist-based XSS filtering consistently fails. Security filters that block <script> may be bypassed using <ScRiPt>, <script/xss>, <img src=x onerror=alert(1)>, or hundreds of other variations. Attackers maintain extensive payload databases specifically designed to evade common filters. Browser parsing differences mean a payload blocked in one browser may execute in another. The continuous evolution of HTML5, JavaScript, and browser features introduces new attack vectors faster than filters can be updated. Organizations relying on pattern matching for XSS prevention face ongoing vulnerability as new bypass techniques emerge.

Solution

Abandon blacklist-based filtering entirely in favor of proper output encoding and allowlist validation. Implement context-aware output encoding: HTML entity encoding for HTML body, JavaScript encoding for script contexts, URL encoding for URLs, and CSS encoding for style contexts. Use established security libraries and frameworks that handle encoding automatically. Deploy strict Content Security Policy (CSP) to prevent inline script execution regardless of filter bypasses. If rich HTML input is required, use proven sanitization libraries (DOMPurify, HTML Purifier) that parse and reconstruct safe HTML rather than attempting pattern-based filtering.

Common Consequences

Impact	Details
Confidentiality	Scope: Confidentiality Bypassed filters allow attackers to execute scripts that steal session tokens, credentials, and sensitive page data through alternate encoding or syntax.
Integrity	Scope: Integrity Successful filter bypass enables page modification, content injection, and unauthorized actions through scripts that evade detection.
Access Control	Scope: Access Control Session hijacking through filter-bypassing payloads enables complete account takeover despite implemented security measures.

Example Code + Solution Code

Vulnerable Code

<?php
// VULNERABLE: Blacklist filtering - easily bypassed
$input = $_GET['q'];

// Filter attempts (all can be bypassed)
$input = str_ireplace('<script>', '', $input);
$input = str_ireplace('javascript:', '', $input);
$input = preg_replace('/on\w+\s*=/i', '', $input);

echo "Search: " . $input;

// Bypasses:
// <scr<script>ipt>alert(1)</script>
// <img src=x onerror=alert(1)>
// <svg onload=alert(1)>
// &#60;script&#62;alert(1)&#60;/script&#62;
// <a href="jav&#x09;ascript:alert(1)">click</a>
?>

Fixed Code

<?php
// SAFE: Output encoding instead of blacklist filtering
$input = $_GET['q'] ?? '';

// Always encode output - handles all variations automatically
$safe_input = htmlspecialchars($input, ENT_QUOTES | ENT_HTML5, 'UTF-8');
echo "Search: " . $safe_input;

// For JSON/JavaScript contexts
$json_safe = json_encode($input, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP);

// CSP header blocks inline scripts even if encoding fails
header("Content-Security-Policy: default-src 'self'; script-src 'self'");
?>

<!-- For rich text, use DOMPurify client-side -->
<script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.0.6/purify.min.js"></script>
<script>
var userContent = /* server data */;
var clean = DOMPurify.sanitize(userContent);
document.getElementById('content').innerHTML = clean;
</script>

Exploited in the Wild

Multiple WAF Bypass Campaigns (Various Organizations, Ongoing)

Security researchers and attackers continuously discover filter bypasses in Web Application Firewalls and custom XSS filters. Documented bypasses have affected WAF products from major security vendors, with new evasion techniques published regularly on security conferences and bug bounty platforms.

https://portswigger.net/web-security/cross-site-scripting/cheat-sheet

Tools to test/exploit

XSS Polyglot Payloads — collection of polyglot payloads designed to execute across multiple contexts and bypass filters.
Burp Suite Intruder — automated testing with XSS payload lists including encoding variations and filter bypasses.
XSS Hunter — blind XSS detection platform for identifying filter bypasses in stored XSS scenarios.

CVE Examples

CVE-2023-49103 — ownCloud XSS filter bypass through alternate encoding.
CVE-2022-40684 — Fortinet authentication bypass enabling XSS through filter evasion.

References

MITRE. "CWE-87: Improper Neutralization of Alternate XSS Syntax." https://cwe.mitre.org/data/definitions/87.html
PortSwigger. "Cross-site scripting (XSS) cheat sheet." https://portswigger.net/web-security/cross-site-scripting/cheat-sheet