1

Background: it is not difficult to introduce vulnerabilities in backend/API code when not coding with security in mind. This typically leads to vulnerabilities such as XSS or various injections (or others).

It is also possible that this backend/API code is intentionally written as malicious - this is something I put on the side, concentrating on the first case.

Question: is it possible (and if so - how) to introduce vulnerabilities via a sloppy Javascript code? In other words: is there Javascript code which can be used by an attacker in a browser context, and in that browser context alone?

Vulnerabilities which lead to server-side issues (XSS, ...) are not in scope, I am wondering about a scenario where the attack would be made possible because of flaws in JS code per se.

In contrast, I know how to use malicious JS code to steal information from the DOM (in the case of, for instance, some widget portal where the JS code running is not vetted). This is not the case I am interested in.

Improve this question
4
  • Just made a simple example. see jsfiddle.net/pk5h66ru and enter '; alert("aa");' into the name. Its quiet useless, but its vulnerable to local XSS. If you would join it with, for example, location href protperty of the window you can pass link to victim and make him to run some code you want.
    – Fis
    May 31, 2017 at 7:57
  • And what is the risk? The same as in case of stored or reflected XSS on server side.
    – Fis
    May 31, 2017 at 8:00
  • I've fixed the example... jsfiddle.net/pk5h66ru/1, enter "; alert("a");"
    – Fis
    May 31, 2017 at 8:06
  • The big security problem with JS these days would be moving info from a screen to a bad guy. without a server, there's not much of a reward for attackers, and thus not a huge risk to clients. if you just have some script running on a non-dynamic webpage, it's hard to imagine the page containing anything secret. There are pure client-side web apps that use localStorage, and those could be ex-filtrated with a careless cut-and-paste or unescaped but displayed input. Those would require user stupidity on targeted attacks, and I don't think that's what you're concerned about...
    – dandavis
    May 31, 2017 at 21:55

1 Answer 1

Reset to default
2

Yes. One type is DOM based XSS. In this case user input is reflected on the page through JavaScript, without having been to the server. Consider the following:

document.getElementById('#message').innerHTML = location.href + " does not exist";

In this case, an attacker can put HTML on the page by putting it in the URL. This makes it possible to run JavaScript in the context of the site.

Improve this answer
1
  • 1
    since <script> tags cannot be executed this way, it might be worth mentioning the vector(s), ex: <img onerror=.... the linked script uses document.write(), which can execute script tags...
    – dandavis
    May 31, 2017 at 21:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .