What are the exact security risks of having JavaScript enabled?

Question

There are a lot of websites out there that state that you should disable JavaScript because of the possible security risks. There's also a reason that an AddOn like NoScript has been developed and is used a lot.

Now, the times I have used JavaScript to enrich user experience the most harming code I was able to have run in the browser was basically just a loop with spamming alert messages, this is more of an annoyance than a security risk though and can easily be disabled by the user on up-to-date browsers.

However, NoScript exists and thus JavaScript can probably do more harm than just message boxes. What real security risks can be exploited when having JavaScript enabled and visiting a website that has malicious JavaScript code? (Assuming a modern JavaScript engine and browser (Chrome, Firefox))

Can information outside of the browser be accessed and sent off to the server?

Can files be downloaded to the client computer without the client's consent?

What serious security threats are there that solely rely on the client JavaScript code that the browser allows?

Answer 1

What serious security threats are there that solely rely on the client JavaScript code that the browser allows?

One risk are buggy implementations which can be used to crash the browser or execute code by using heap spraying attacks or similar. These can be kind of mitigated within modern browsers by using ASLR, DEP, sandboxes and similar techniques.

More interesting are attacks like Cross Site Scripting (XSS). These attacks can be used to steal authorization credentials (i.e. passwords) or hijack existing sessions. This way they can be used for identity theft or misuse. They work because the same browser is used for different web sites (i.e. banking and looking at cats) and this way it tears down security borders between these sites. Same Origin Policy is only of limited use in these cases.

A typical case of such attacks is the inclusion of third party scripts into a web site. This can be external Javascript libraries, tracking code like google analytics, buttons for social networks or advertisement. This included code is out of the control of the original web site but still has full access to the site inside the browser and can thus read information from it, fill in forms or read their content, navigate the user to different sites, press like buttons, inject advertisements or malware etc.

Apart from that Javascript can be used to fingerprint the browser in a more detailed way which might be a problem especially when trying to be anonymous.

Can information outside of the browser be accessed and sent off to the server?

It should not be possible to access files on the local machine (at least not without notification) but with attacks like DNS rebinding it can be possible to read the contents from intranet web sites and forward these information to the attacker.

Also bugs in local or intranet servers can be used to hijack connections to third party side like done in this example of same site scripting.

Can files be downloaded to the client computer without the client's consent?

This can usually not be done with Javascript alone but is often done by using bugs in Flash or Java.