I have been looking into XSS pertaining to base64 encoding a data URI into an
<object> tag (which is typically considered only a feasible XSS payload in Firefox), but I am failing to understand how this is a XSS attack? For example (I didn't base64 encode it so that you guys can easily read it):
The above example will, indeed, trigger an alert(), but it will be placed in an area within the page that is considered a completely separate page (separate from the host's DOM), so that
document.cookie will return nothing useful. Likewise, if I were to try and capture the parent window's cookies, it will (on Firefox) reject it because embedded data URIs are considered Cross Origin:
The above example will result in: "Uncaught DOMException: Permission denied to access property "document" on cross-origin object". Furthermore, this also means that any payload an attacker were to put in an
<object> via the Data URI will not have access to the parent window's DOM. So, with that in mind, the only thing I can think of that an attacker could utilize this for is to embed a malicious form of some sort to try to capture user credentials: but that can be achieved by embedding mere HTML into data object, thus requiring no JS. I keep seeing in XSS cheatsheets a reference to this kind of attack, but where's the XSS side of this? Sure, I could embed whatever HTML I want in the object tag, but the JS part of it would only be for mere animations (and not XSS), no? Wouldn't it just be a way for an attacker to embed their own HTML to capture credentials? Is that the whole point or am I missing something?