Background: it is not difficult to introduce vulnerabilities in backend/API code when not coding with security in mind. This typically leads to vulnerabilities such as XSS or various injections (or others).

It is also possible that this backend/API code is intentionally written as malicious - this is something I put on the side, concentrating on the first case.

Question: is it possible (and if so - how) to introduce vulnerabilities via a sloppy Javascript code? In other words: is there Javascript code which can be used by an attacker in a browser context, and in that browser context alone?

Vulnerabilities which lead to server-side issues (XSS, ...) are not in scope, I am wondering about a scenario where the attack would be made possible because of flaws in JS code per se.

In contrast, I know how to use malicious JS code to steal information from the DOM (in the case of, for instance, some widget portal where the JS code running is not vetted). This is not the case I am interested in.

  • Just made a simple example. see jsfiddle.net/pk5h66ru and enter '; alert("aa");' into the name. Its quiet useless, but its vulnerable to local XSS. If you would join it with, for example, location href protperty of the window you can pass link to victim and make him to run some code you want. – Fis May 31 '17 at 7:57
  • And what is the risk? The same as in case of stored or reflected XSS on server side. – Fis May 31 '17 at 8:00
  • I've fixed the example... jsfiddle.net/pk5h66ru/1, enter "; alert("a");" – Fis May 31 '17 at 8:06
  • The big security problem with JS these days would be moving info from a screen to a bad guy. without a server, there's not much of a reward for attackers, and thus not a huge risk to clients. if you just have some script running on a non-dynamic webpage, it's hard to imagine the page containing anything secret. There are pure client-side web apps that use localStorage, and those could be ex-filtrated with a careless cut-and-paste or unescaped but displayed input. Those would require user stupidity on targeted attacks, and I don't think that's what you're concerned about... – dandavis May 31 '17 at 21:55

Yes. One type is DOM based XSS. In this case user input is reflected on the page through JavaScript, without having been to the server. Consider the following:

document.getElementById('#message').innerHTML = location.href + " does not exist";

In this case, an attacker can put HTML on the page by putting it in the URL. This makes it possible to run JavaScript in the context of the site.

  • 1
    since <script> tags cannot be executed this way, it might be worth mentioning the vector(s), ex: <img onerror=.... the linked script uses document.write(), which can execute script tags... – dandavis May 31 '17 at 21:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.