There is some basic confusion that I have.
A non-suspecting victim visits a vulnerable website, vulnerable.com
and logs in there. vulnerable.com
, post login, sends back a response that has the following HTTP header set,
Access-Control-Allow-Credentials: True
Access-Control-Allow-Origin: vulnerablesite.com
Let us say that the session cookie is scoped to /home.html
path alone (which may not make much sense, but let's just assume so for the sake of this discussion) and does not have HTTPOnly flag set.
Now in the same browser he opens a new tab and visits vulnerablesite.com/some_page.html
An attacker identifies a stored XSS in vulnerablesite.com/some_page.html
and decides to exploit it to gain access to the session cookie of the user on vulnerable.com
.
To do so, the attacker injects an AJAX script in vulnerablesite.com/some_page.html
, so when the victim visits the page, it will make an AJAX request to vulnerable.com/home.html
. Now this request will definitely succeed (no reason for it to not to and also because Access-Control-Allow-Credentials
was true) and the response that's received will also be readable by the attacker's AJAX script (because of Access-Control-Allow-Origin
was set to vulnerablesite.com
, so no same origin policy violation)
When the attacker's AJAX script says xhr.response, this response object will definitely hold the /home.html
page.
The main confusion is around the path and domain attributes of the cookie. Questions
- So in this case when the attacker's script says document.cookie now, will the attacker be able to read the session cookie of the victim?
- because the cookie is scoped to
/home.html
, any request made to/home.html
will carry this cookie along. But because the response to/home.html
is not doing a set-cookie at all, when attacker's ajax say document.cookie what will exactly be read? - have no idea about what the domain attribute would be of the cookie in this case and how will it impact the reading of the cookie in anyway if at all it will.