There is some basic confusion that I have.
A non-suspecting victim visits a vulnerable website,
vulnerable.com and logs in there.
vulnerable.com, post login, sends back a response that has the following HTTP header set,
Let us say that the session cookie is scoped to
/home.html path alone (which may not make much sense, but let's just assume so for the sake of this discussion) and does not have HTTPOnly flag set.
Now in the same browser he opens a new tab and visits
An attacker identifies a stored XSS in
vulnerablesite.com/some_page.html and decides to exploit it to gain access to the session cookie of the user on
To do so, the attacker injects an AJAX script in
vulnerablesite.com/some_page.html, so when the victim visits the page, it will make an AJAX request to
vulnerable.com/home.html. Now this request will definitely succeed (no reason for it to not to and also because
Access-Control-Allow-Credentials was true) and the response that's received will also be readable by the attacker's AJAX script (because of
Access-Control-Allow-Origin was set to
vulnerablesite.com, so no same origin policy violation)
When the attacker's AJAX script says xhr.response, this response object will definitely hold the
The main confusion is around the path and domain attributes of the cookie. Questions
- So in this case when the attacker's script says document.cookie now, will the attacker be able to read the session cookie of the victim?
- because the cookie is scoped to
/home.html, any request made to
/home.htmlwill carry this cookie along. But because the response to
/home.htmlis not doing a set-cookie at all, when attacker's ajax say document.cookie what will exactly be read?
- have no idea about what the domain attribute would be of the cookie in this case and how will it impact the reading of the cookie in anyway if at all it will.