2

Say there is a service online that takes as input a DOM string, loads that DOM in a browser on their server, and returns a screenshot.

Would it be possible for the online service to completely protect the integrity of the host machine itself against XSS attacks?

My understanding is that XSS attacks rely on user interaction to be effective. If there is no user interacting with the browser, and only screenshots are taken, sure any sort of crazy content could be loaded into the browser, but could the security of the host itself be compromised?

  • Why not just simply escape characters ? It seems really odd to do a screenshot. Moreover, it is still dangerous for your server. Imagine if the user is able to inject javascript --> infinite loop and your server could crash. – Xavier59 May 27 '16 at 20:47
  • You could deactivate Javascript in the browser on your server. That said, you might want to directly integrate a rendering engine (e.g. WebKit) in your code instead of starting up a real browser. – Arminius May 27 '16 at 22:35
1

While there's a input that anyone can modify, not sanitized and returned to the user we will have a XSS vector.

The "classic" example is the select that receives the option through the URL:

...
Select your language:
<select><script>
document.write("<OPTION value=1>"+document.location.href.substring(document.location.href.indexOf("default=")+8)+"</OPTION>");
document.write("<OPTION value=2>English</OPTION>");
</script></select>
...

So if a malicious user instead of send a standard answer like:

http://www.some.site/page.html?default=French

Send a request like this:

http://www.some.site/page.html?default=<script>alert(document.cookie)</script>

The user cookies will be shown on the alert.

Some links for reference on DOM Based XSS and how to prevent it.

https://www.owasp.org/index.php/DOM_Based_XSS https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet

  • This would definitely work if the server did not clear cookies between each request. You could see the cookies that were the result of a previous user's request. But it would not compromise the host itself, right? Like the operating system, file system, memory, etc. – Cory Klein May 27 '16 at 21:05
  • Well, maybe you will like to have some user experience customized or maybe some sessions and for that you will need cookies, so maybe it's not possible to wipe off the cookies between each request, right? Related to the possible damage that may suffer the host as @Xavier59 already pointed, in the case of a exploitable XSS vector an attacker may inject an infinite loop and cause a DoS. Remember that it's not possible to thrust any input. All must be sanitized. – raziel May 27 '16 at 21:17
  • @CoryKlein To my knowledge, no XSS attack "compromise the host itself". – Anders May 27 '16 at 21:20
  • Well, that depends on what you mean by an XSS attack I suppose. You could use the XSS to load up BEEF and from there deliver different metasploit modules to the browser: github.com/beefproject/beef/wiki/Metasploit – Erlend May 30 '16 at 5:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.