I am wondering what risks there are if you have static pages on the same host that don't trust each other. A key concept of Javascript and web security is the Same Origin Policy (SOP), which is also the reason why we need to avoid XSS. If there's e.g. a blog on example.org with an admin interface on example.org/admin and an attacker can place some javascript on example.org/foo then the attacker can execute javascript that e.g. will create a new admin account or perform other actions on behalf of the admin. I generally understand how this is happening.

However I wonder the following: If the pages on example.org are all static, i.e. no forms that perform actions or endpoints that act on POST requests, does the SOP still matter?

I was thinking of attacks like: Can example.org/foo/ open example.org/bar/, but with manipulated content? This could be useful e.g. if example.org/foo hosts downloads that an attacker can manipulate or redirect. I have tried a few things, but I wasn't able to perform such an attack. (One way might be ServiceWorkers, but they are path constrained, which limits possibilities quite a bit.)

And are there other attacks that one should care about in purely static scenarios?

  • If the site is static content only then how would you manage an XSS attack in the first place? Nov 13 '20 at 20:03

XSS generally impacts integrity and confidentiality (an attacker can read and modify data they shouldn't).

If you only have static pages with no authentication and/or user-specific content, then confidentiality may not be as important (an attacker may eg still be able to log which specific pages a victim user views, which depending on the nature of the site may not be desired).

Possibly of higher interest is that the integrity of the site is in danger. An attacker can show what they like to a user, eg a login page, or as you note, they can replace all links. A very simple example would be:

var w = window.open("http://example.com/a.html",'_blank');
w.onload = function() {
    var links = w.document.getElementsByTagName("a");

    for (var i = 0; i < links.length; i++) {
        links[i].href = "http://evil.com"

Additionally, you may run into problems if another origin trusts the vulnerable origin (eg https://blog.example.com is vulnerable to XSS, and https://admin.example.com has a CORS policy trusting all *.example.com domains).

  • I tried something like your window.open example. However that is usually blocked by the browser's popup blocker, this will thus only work if the user manually approves the popup. Which I think makes this a rather unlikely threat scenario. Are you aware of any such method that works out of the box?
    – hanno
    Feb 17 '20 at 19:14
  • document.location.replace('https://evil.com') just redirects the user to an evil landing page. No Popup needed.
    – BenjaminH
    Feb 18 '20 at 10:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.