Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am using various 3rd party libs like cordova.js, jquery, jquery mobile, mobilizer and so on, in a an android mobile app.. These libs are found to have various XSS vectors through insecure use of eval, settimeout, inner/outerhtml and so on. However, the modules which have these issues are not used/called in the application.

Considering the above scenario, Is there any way by which an attacker can exploit my app based on the XSS vectors in the 3rd party libs, even if the vulnerable modules are not used in my app?

share|improve this question
1  
You have answered the question. It depends on the module you are using.If there is a vulnerability in the module, it can be exploited like bugs.jqueryui.com/ticket/6016..This was a previous vulnerability in jquery. So it is better to check the existing vulnerabilities in 3rd party libraries before using them –  aRun Mar 12 '13 at 7:50
add comment

2 Answers

Possible, but unlikely. Why?

Allow me give you some background information. I've seen people obsess over supposed "XSS vulnerabilities" in jQuery and many other libraries, here's one example:

$('#inputElement').keyup(function () {
   $('#someDiv').html($(this).val())
});

Some would argue that this code is vulnerable to XSS, which is not true. Yes, you can write JavaScript in the input field and have it executed (for example, <script>alert(document.cookie)</script) but so what? You can already do that with with any application that gives you JavaScript console (Firebug), heck, you can even do it with Greasemonkey.

It can be only considered an XSS vulnerability if data from outside your app is used inside your app by tricking the user into malicious URL or submitting a specially crafted form. Here's an example:

$(document).ready(function () {
   $('#someDiv').html(window.location.hash)
});

Now this is vulnerable to XSS, an attacker could craft the following URL

http://example.com/search/searchQuery+<script>alert(document.cookie)</script>

Or even use some URL shortening services to make the attack a bit more obfuscated. The point is, in such cases you need to worry.

If the client side of your webapp is using data from outside and it's possible that the legitimate user might not have control over it (like the case above), then you need to worry.

Another example using History API-fallback libraries, such as jQuery BBQ (it parses window.location.hash) which might be vulnerable and somehow allows code in the URL to be executed.

Please note that this answer is strictly in the scope of your question; XSS attacks related to JavaScript libraries.

share|improve this answer
add comment

Yes, definetely. Here is a recent example from Yahoo, where an old JS library caused an XSS http://abysssec.com/files/Yahoo!_DOMSDAY.pdf

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.