What is Cross-Site Scripting (XSS)?

Short answer

Cross-Site Scripting (XSS) is an attack that places a malicious script in a web page through user input and runs it in the browsers of other users who visit the page; it is used to steal session information, take over the account or change the page content (OWASP, CWE-79). It arises in applications where the input is printed to the page without being encoded; in the OWASP Top 10:2021, it is in the A03 Injection category. In TR7 WAF, it is the Cross-Site Scripting category of the signature library; the signatures in this category scan the Path, Query, Header, Form, JSON, XML and Raw fields of the request, the score of the matching signature is added to the attack score of the request, and if the score reaches the OWASP Protection Level threshold, the request is blocked in Blocking mode. On the browser side, security headers such as Content-Security-Policy provide an additional layer.

Where It Is Used in TR7

Where	Field / label	What for
Configuration Menu → WAF → Signature & Rule Library → Filter	Signature Categories → Cross-Site Scripting	Listing the signatures of this attack type and managing their states (Enabled, Monitor, Disabled)
Signature & Rule Library → Columns	Signature Category, CWE, OWASP Web Coverage columns; hidden by default	Seeing the category and classification of the rule in the table
Left Monitor Panel → WAF-Protected vServices → vService → Dashboard	Detected Attacks by Category	The distribution of the detected attacks across categories
WAF-Protected vServices → vService → Event Logs	Filter strip → Category; the Attacks tab of the record preview	Seeing which signature and category a blocked or monitored request was caught by

• The additional layer on the browser side: What are HTTP security headers? · What is Content-Security-Policy (CSP)?
• Category list: Which attack categories do the signatures cover?

Common Misconceptions

• "XSS attacks the server." The target is the browser of the users who visit the page; the server is the intermediary that carries the malicious content.
• "WAF alone puts an end to XSS." WAF is an additional layer that catches known patterns in the request; the real solution is the application encoding its output.
• "A request caught by an XSS signature is always blocked." Blocking depends on the total attack score of the request reaching the OWASP Protection Level threshold and on the WAF being in Blocking mode. In Monitor mode, the request is only recorded; in Learning mode, signature hits are not added to the score.

How it is done in the documentation

• Signature & Rule Library · Signature Categories
• Signature & Rule Library · Score Values and the Protection Level
• WAF · The Blocking Threshold

Related questions

• Which attacks does TR7 WAF protect against?
• Which attack categories do the signatures cover?
• What is SQL Injection?
• What are OWASP and the OWASP Top 10; where do they appear in the TR7 WAF?