title: Reflected Cross-Site Scripting in SharePoint Search Box Web Part
body: <p>While a third party company executing a security assessment on our SharePoint 2013 project. The Security Assessment was comprised of a Vulnerability Assessment. The Cycura determined that the "Search Box Web Part" functionality is vulnerable to XSS attacks. </p>
  
  <p>The Proof of Concept came up like below:</p>
  
  <pre><code>Vulnerable parameter: "k":"String"
  Payload: "test"&gt;&lt;a onmouseover="alert('xss')"&gt;xxx
  GET /Pages/SearchResults.aspx?k=test"&gt;&lt;a onmouseover="alert('xss')"&gt;xxx HTTP/1.1 Host: wwwqa.xyz.com
  User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:53.0) Gecko/20100101 Firefox/53.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 
  Accept-Encoding: gzip, deflate, br 
  Cookie: _ga=GA1.3.911615250.1492781812; dtLatC=31; dtPC=256094571_636h3; WSS_FullScreenMode=false; SearchSession=4d21f382%2D23e3%2D4f86%2D91ad%2Dc6c712e70704; 
  _gat_UA-82498113-1=1; dtCookie=911302E10B144FAA0C644F92C2950F93|UUErZUN1c3RvbWVyfDE 
  Connection: close 
  </code></pre>
  
  <p>Upgrade-Insecure-Requests: 
  1<a href="https://i.stack.imgur.com/r0Vqc.png" rel="nofollow noreferrer">enter image description here</a>
  The recommendations was to perform sanitization and input validation on user supplied data. the steps of validation, sanitization and escaping should happen both in client and server side. Whenever possible. </p>
  
  <p>Did anyone had the same security assessment issue and if anyone managed to resolve or get an idea how to manage that since this is using SP OOTB search box web parts.</p>
  
  <p>Much appreciate your help and contributions.</p>