Ready to Start Your Career?

Text Injection in Error Pages - Rainforest

vinothpkumar 's profile image

By: vinothpkumar

October 20, 2016


Hi Readers,

Probably, this is one of the easiest security issue (missing best security practices) one can find in any web application. Whenever you try to access any url which is not in the server, you get 404 page. But sometimes, the error message will be displayed like as shown below.


As you can see, our input (“/test”) is being reflected in the web page. The attacker can make use of this opportunity to embed his own input. above URL will be rendered as shown below:

rainforestqa 1.png

Even though it is not a security issue, it is advisable not to render user inputs in the error message. Instead, throw a 404 error page. Most companies don’t accept it as a security issue. But I really appreciate Rainforest team to consider my submission. They fixed even this low impact issue. Please find the image below.

rainforest 3.png

 I’ve written a blog post on the same:

Thanks and Regards,

Vinoth Kumar

Schedule Demo