Riding out DOMsday: Towards Detecting and Preventing DOM Cross-Site Scripting

Abstract

Cross-site scripting (XSS) vulnerabilities are the most frequently reported web application vulnerability. As complex JavaScript applications become more widespread, DOM (Document Object Model) XSS vulnerabilities-a type of XSS vulnerability where the vulnerability is located in client-side JavaScript, rather than server-side code-are becoming more common. As the first contribution of this work, we empirically assess the impact of DOM XSS on the web using a browser with taint tracking embedded in the JavaScript engine. Building on the methodology used in a previous study that crawled popular websites, we collect a current dataset of potential DOM XSS vulnerabilities. We improve on the methodology for confirming XSS vulnerabilities, and using this improved methodology, we find 83% more vulnerabilities than previous methodology applied to the same dataset. As a second contribution, we identify the causes of and discuss how to prevent DOM XSS vulnerabilities. One example of our findings is that custom HTML templating designs-a design pattern that could prevent DOM XSS vulnerabilities analogous to parameterized SQL-can be buggy in practice, allowing DOM XSS attacks. As our third contribution, we evaluate the error rates of three static-analysis tools to detect DOM XSS vulnerabilities found with dynamic analysis techniques using in-the-wild examples. We find static-analysis tools to miss 90% of bugs found by our dynamic analysis, though some tools can have very few false positives and at the same time find vulnerabilities not found using the dynamic analysis.

XSS Vulnerabilities in Cloud-Application Add-Ons

“…First, state-of-the-art automated techniques for detecting XSS vulnerabilities in the web typically work with client-side XSS [33,35,49,53], whereas the XSS attacks against cloud-application add-ons may also exist on the server side. For example, the vulnerabilities of MS Office Online add-ons are always on the client side because the attacker's malicious input is propagated to the add-on via local messaging (i.e.…”

Security Study of Service Worker Cross-Site Scripting.

“…Our attack also utilizes cross-domain file inclusion to launch the SW-XSS attack, thus we share the same sentiment regarding this issue. In recent years, a variant of XSS called DOM-XSS is emerging [17,18,23]. DOM-XSS can be similar to our attack in a sense that it allows attackers to execute remote code on the client-side.…”

Assessing the Impact of Script Gadgets on CSP at Scale

“…We only investigate CSP in isolation. In addition to that, research has shown that a non-negligible fraction of sites suffers from markup injection vulnerabilities [13,15,30].…”