What Same Origin Policy related risks are there with static pages?

Question

I am wondering what risks there are if you have static pages on the same host that don't trust each other. A key concept of Javascript and web security is the Same Origin Policy (SOP), which is also the reason why we need to avoid XSS. If there's e.g. a blog on example.org with an admin interface on example.org/admin and an attacker can place some javascript on example.org/foo then the attacker can execute javascript that e.g. will create a new admin account or perform other actions on behalf of the admin. I generally understand how this is happening.

However I wonder the following: If the pages on example.org are all static, i.e. no forms that perform actions or endpoints that act on POST requests, does the SOP still matter?

I was thinking of attacks like: Can example.org/foo/ open example.org/bar/, but with manipulated content? This could be useful e.g. if example.org/foo hosts downloads that an attacker can manipulate or redirect. I have tried a few things, but I wasn't able to perform such an attack. (One way might be ServiceWorkers, but they are path constrained, which limits possibilities quite a bit.)

And are there other attacks that one should care about in purely static scenarios?

Answer 1

XSS generally impacts integrity and confidentiality (an attacker can read and modify data they shouldn't).

If you only have static pages with no authentication and/or user-specific content, then confidentiality may not be as important (an attacker may eg still be able to log which specific pages a victim user views, which depending on the nature of the site may not be desired).

Possibly of higher interest is that the integrity of the site is in danger. An attacker can show what they like to a user, eg a login page, or as you note, they can replace all links. A very simple example would be:

var w = window.open("http://example.com/a.html",'_blank');
w.onload = function() {
    var links = w.document.getElementsByTagName("a");

    for (var i = 0; i < links.length; i++) {
        links[i].href = "http://evil.com"
    }
}

Additionally, you may run into problems if another origin trusts the vulnerable origin (eg https://blog.example.com is vulnerable to XSS, and https://admin.example.com has a CORS policy trusting all *.example.com domains).