0

I'm looking for a formal characterization of an attack that exploits the prototypical method override feature in Javascript programs. For instance, if an attacker successfully overrides the Object.prototype.toString method, he/she could get access to objects and data that may be thought to be "hidden" in closures, whenever those "hidden" values have their toString() methods invoked.

I created a more elaborated example in which an attacking script leaks sensitive information propagated into the Crypto Javascript API -- see it here in action.

Is this technique/approach a form of XSS attack? If so, is there an established name for it?

Improve this question
1
  • That sounds like a sandbox escape. There have been many, e.g. this XSS is slightly different - it's about bypassing the same-origin model.
    – paj28
    Commented Jan 15, 2018 at 20:47

2 Answers 2

Reset to default
1

You don't seem to be specifying the vector by which the untrusted code is run. This seems to be a good example of an attack that leverages how hard it is to sandbox / prevent vulnerabilities when loading and executing untrusted code. While XSS is the most common vector for getting untrusted code to run in javascript, this does not seem to be an XSS.

This is similar to a CERT java issue: https://www.securecoding.cert.org/confluence/display/java/OBJ57-J.+Do+not+rely+on+methods+that+can+be+overridden+by+untrusted+code

Improve this answer
1

You aren't describing an attack here. What you are describing here is something an attacker could do after they managed to find an attack which allows them to inject arbitrary javascript code into a context where it doesn't belong.

There are several ways how that injection could happen. A cross-site-scripting (XSS) attack is one, but there are lots of other kinds of script injections.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .