Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As the exploit isn't sent to the server (using #payload), can I say that a DOM XSS is a vulnerability in the browser rather than the web application?

share|improve this question
add comment

4 Answers

As the application provides the logic that results in unexpected behavior DOM based XSS is clearly an application issue.

DOM-based XSS protections are built-in to many modern browsers, but you should not rely on them as they protect against a smaller subset of attacks.

Edited to clarify that one should not rely upon browser features for XSS protections.

share|improve this answer
    
DOM-based XSS protections are built-in to many modern browsers though. Examples? –  copy Jul 1 '13 at 14:02
    
The latest browser where I was able to trigger a schoolbook example DOM-based XSS (sg. like document.write(document.location.href)) was IE6 if I remember correctly. –  buherator Jul 1 '13 at 15:49
2  
document.write(document.location.href) only fails because of URL-encoding. The traditional example of DOM XSS, element.innerHTML='Hello '+user_input, is not prevented by either of the extant browser anti-XSS schemes. Browser anti-XSS only deals with input directly reflected into the immediate HTML, which is a small subset of injection problems (and even then it can't catch every possible case). Do not rely on it. –  bobince Jul 1 '13 at 19:29
add comment

So what is the application? There are frameworks like Backebone.js which implement the entire MVC of the application in JavaScript on the client. The server-side component of this very small, and just a data access layer.

So to answer your question, DOM Based XSS affects the client-side component of a web application.

share|improve this answer
add comment

Document Object Model vulnerability is an XSS attack wherein the attack payload is executed as result of modifying the DOM environment. The javascript code is executed on the client side so I can say that its an application side vulnerability.

DOM-based vulnerability example - http://www.example.com/pages.html?default=alert(document.cookie)

See OWASP for more information about XSS DOM-based vulnerabilities

share|improve this answer
add comment

It's an application vulnerability. Some browsers go quite far in trying to prevent it, but the problem is not the browser, but the client-side part of the application.

Modifying the DOM from JavaScript is a common and useful technique, even (or especially) using dynamically-constructed document structure. Because of this, a browser that knows nothing about the intended application logic can only stop the most obvious attacks, and while it is nice that they try to do this, the main responsibility is with the application, not the browser.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.