2

Reading up the XSS attacks on wiki I see that it says an injected script could send data/cookies to the attackers site. How is this achieved? Are there no checks/restrictions on cross origin requests like this from a browser? I thought the CORS spec was specifically done for this purpose and the original site must set the "helper" sites in the Access-Control-Allow-Origin header. Am I missing something or is it not needed? Can I just do a HTTP post to any server from any page?

EDIT: I think I answered my own question here. The injected script can fetch code from the attackers site thus making it run within the original site's code. That makes the attackers site ok to post to. Is this correct? Any other information welcome.

Improve this question
1
  • 1
    CORS != XSS. XSS is a hack used by attacker to break the SOP, CORS allows developers to choose what SOP rules to ignore.
    – rook
    Commented Sep 12, 2014 at 15:33

1 Answer 1

Reset to default
1

If you use CORS for anything else then XMLHTTPRequest (which historically defaulted to only allow same origin) it has to be supported on the client side (browser) and it also has to explicitly used on the server side.

By default cross origin requests can be done simply be including an image, stylesheet, script etc from another site and if you have a successful XSS you can use it to send for example the session cookie inside such a request. To make this impossible you would need to check each request at the server side (e.g. requesting a same-site Origin or Referer and do not allow empty Origin/Referer) or limit cross-site requests at the client side (using Content-Security-Policy, not supported by all recent browsers).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .