1

Suppose that a user on a corporate network has access to a private FTP server, or intranet site, that's only available on the Local Area Network, available at http://internal.example.com. If an attacker gets this user to view a malicious website, is there anything, or any way to stop the attacker from including a script on the page that accesses this internal site, and even possibly running an exploit on it (as internal sites often have more lax security), all from the user's privileged network position?

Even if the attacker doesn't know the exact nature of the internal services, things like port scanning can now be done with javascript: http://blog.andlabs.org/2010/12/port-scanning-with-html5-and-js-recon.html

Improve this question

2 Answers 2

Reset to default
0

The attacks you refer to are for example CSRF or DNS Rebinding, but there are also others. With some of these attacks one can only send a request (write-only) and with some the attacker can also read the response.

The only full protection is probably to configure a browser to use a proxy for all requests (even local or internal ones) and then configure the proxy in a way that it has no access to internal sites, i.e. block all connections going from the proxy server to the internal network. Of course this browser then could no longer access internal sites by design. This means you need to use a different browser for internal sites, which of course should not be able to access external sites. This can be achieved in a similar way, i.e. configure the browser to use a proxy for all requests and configure this proxy so that it only has access to the local intranet and not to the external internet. And of course everything else in the network should be restricted so that the only way to access internal or external resources is by using these proxies.

Improve this answer
2
  • Interesting. Why is this something that browser vendors have not as of yet really tackled?
    – TheInnerParty
    Nov 3, 2015 at 11:23
  • 1
    @TheInnerParty: Linking and embedding other sites is a design feature of the web and cannot be simple abandoned. And it is not only about internal vs. external sites, i.e. CSRF etc works also between external sites only. Apart from that these problems can in theory be fixed at the server or web application site, only that they often don't get fixed. In other words: the web is insecure by design and every security you need you must add explicitly.
    – Steffen Ullrich
    Nov 3, 2015 at 11:40
0

I think I figured it out. This potential attack is addressed with Same-origin-policy. A browser will only allow scripts to access resources from the same origin. https://en.wikipedia.org/wiki/Same-origin_policy

Improve this answer
1
  • 1
    Wrong. Same Origin Policy does not restrict the request itself but restricts that the contents of the response can be used. In lots of cases you don't need the response. A classical example for such attacks are CSRF like in this case.
    – Steffen Ullrich
    Nov 3, 2015 at 9:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .