title: ASP.NET WebForms Form Action XSS Vunerability?
body: <p>I have been working on addressing some vulnerabilities highlighted by the <code>Acunetix Web Scanner</code>, in particular those relating to <code>XSS</code>.</p>
  
  <pre><code>www.mywebsite.com/signed-out/blahblah
  </code></pre>
  
  <p>due to the re-write rules the 'blahblah' is taken as a parameter of a query string, ie. </p>
  
  <pre><code>www.mywebsite.com/internal/path/LoggedOut.aspx?reason=blahblah
  </code></pre>
  
  <p>What the tool has noticed is that you can enter <code>javascript:prompt(919416);</code> as the <code>queryString</code> and <code>ASP.NET</code> seems to modify the form action automatically to:</p>
  
  <pre><code>&lt;form name="aspnetForm" method="post" action="javascript:prompt(919416);?reason=session-expired%2fjavascript%3aprompt(919416)%3b" id="aspnetForm"&gt; 
  </code></pre>
  
  <p>Which reflects the input queryString. However:</p>
  
  <ol>
  <li>Is this actually executable?</li>
  <li>I can't seem to find how to stop ASP.NET modifying the form action.</li>
  </ol>
  
  <p>I'm still new to this area, please be gentle! Any help and advice greatly appreciated.</p>