If the intention of attacker is to execute an arbitrary client side script in the context of a web application, is XSS the only possible attack other than compromising the server with an RCE or a sub-resource supply chain attack?

  • XSS is Cross Site Scripting - Be it reflected, persistent or DOM based.
  • A sub-resource supply chain attack is where you compromise a sub resource such as CSS, javascript, flash objects etc by compromising the supply chain ie; compromising the CDNs, S3 buckets etc or by MITM a subresource loaded over non-https channel.

1 Answer 1


Note that this answer applies to the initial version of the question which was less strict and clear about what the OP would actually like to know.

To execute malicious script on the client side in the context of the web application the script

  • might be injected cross site by the attacker for example inside the URL (reflected XSS)
  • might be served by the original webserver because the server was compromised or had a stored XSS vulnerability
  • might be done by loading or moving the client side of the application into some unexpected context (DOM XSS)
  • might be injected on the client side using a browser extension, which can be controlled by the attacker either because the extension is malicious or has bugs
  • might be injected by misusing script includes for third-party, for example when including ads or tracking (malvertising)
  • might be provided by the attacker using a MITM attack (thanks to Anders for this idea)

And of course there might be bugs in the browser which makes this possible (universal XSS).

  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop
    Jan 10, 2020 at 14:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .