XSS attacks and style attributes

Question

There are known Style Attribute XSS attacks like:

Or

Answer 1

Yes, you can use XSS attacks with Style attributes .

These styles were injected as we didn't have them declared in our tags in a particular jsp page but got through when audited by our security group:

I'm thinking of using an HTTP filter to stop it here, but I'm still looking into it.

We also didn't have our hidden input fields proteccted either and this got through as well:

With a tool like Burpsuite, you can modify requests on the fly to inject XSS into tags like this. However, with the ESAPI API's from OWASP, you can add protection. We weren't using JSTL tags as it was old legacy code, so that was the best short term solution.

For the hidden input I used;

You can also use XSS with the js onload event in an img tag: