What is HTML injection?

Hypertext Markup language (HTML) is considered the backbone of any web application as the whole structure depends on HTML code. What if this HTML code is misconfigured and has a security vulnerability? It could lead to an HTML injection attack which means an attacker can take advantage of this and can inject malicious HTML into this web application to modify a web page presented by a web application to its users in order to gather data from them.

HTML injection attack is similar to Cross-site scripting(XSS) in this the attacker can inject malicious javascript code into the websites but in the case of an HTML injection attack the HTML tags are modified and if the website is highly vulnerable it can allow an attacker to gain access of the system as well.

Types of HTML injection:

1. Reflected HTML injection

It can also be subdivided into three parts:

• Reflected GET
• Reflected POST
• Reflected URL

In this attack, the malicious HTML code is not kept on the website permanently but this attack occurs when a website reacts right away to malicious input this is done by the POST and GET methods.

2. Stored HTML injection

In this attack, the malicious HTML code is permanently saved into the web server and it gets executed each time a user invokes the necessary functionality.

Example of HTML injection:

Suppose the attacker discovers a site that has injection vulnerability, then the attacker crafts a malicious link and sends malicious HTML content injected in it to the victim through email or some other mechanism, and then the user as soon as clicks on this malicious link thinking it is as a trusted domain the injected HTML code is rendered and ask for the victim’s privileges and when the user enters his data instead of sending this sensitive information to the web site server it is sent to the attacker’s server which allows him to gain access of this information and also he can compromise the user’s computer.

Impact of HTML injection:

• A potential attacker could use it to modify the web page.
• HTML injection can lead to cross-site scripting (XSS) attacks and Server-Side Request Forgery(SSRF).
• Using the HTML Injection vulnerability, threat actors can produce bogus web pages.
• It can be used to steal a user’s identity.
• It can damage your company’s reputation as users will think your company doesn’t take security seriously.

Mitigation of HTML injection:

• The developers can verify the user input by evaluating its length, type, and format.
• Any user input that the application will output should be encoded by the developers.
• Security testing must be performed on the web applications.
• There are numerous functions available to determine whether the code has any unique brackets. The checking function you choose will depend on the programming language you’re using.
• The programmer needs to configure his HTML script such that it removes metacharacters from user inputs.
• To prevent this attack the developer must validate the appropriate data.