CWE-87 is a product that does not neutralize user-controlled input for alternate script syntax.
It is a reminder that "script" is not one thing in a browser, and a filter written for the common form can miss the rest.
How it happens
A filter recognizes script tags and a few known patterns. The attacker uses a different syntax the browser also accepts. The record lists one observed example: CVE-2002-0738, XSS using an ampersand, equals sign and a script wrapped in curly braces. See CVE-2002-0738.
The lesson is wider than that one syntax. Any filter that matches a fixed list of forms will miss a form that was not on the list.
What an attacker gains
MITRE lists confidentiality, integrity and availability: reading application data and executing unauthorized code or commands.
How to find it
The record lists no detection methods. Test filters against collections of XSS variants, including unusual syntax, instead of only the common script tag.
How to fix it
- Resolve all input to absolute or canonical representations before processing.
- Check each parameter against an allowlist of allowed characters and format. Neutralize all data in the request, including tag attributes, hidden fields, cookies, headers and the URL, not only the fields you expect to show. A field that is not reflected today may be reflected by a future developer.
- Escape on output for the context where the data lands.
Quick check
Why does an allowlist beat a list of known script forms?
It does not need to know every alternate syntax. Anything outside the allowed characters and format is rejected.
