I have been looking into XSS pertaining to base64 encoding a data URI into an <object>
tag (which is typically considered only a feasible XSS payload in Firefox), but I am failing to understand how this is a XSS attack? For example (I didn't base64 encode it so that you guys can easily read it):
<object data="data:text/html,<script>alert(document.cookie)</script>"></object>
The above example will, indeed, trigger an alert(), but it will be placed in an area within the page that is considered a completely separate page (separate from the host's DOM), so that document.cookie
will return nothing useful. Likewise, if I were to try and capture the parent window's cookies, it will (on Firefox) reject it because embedded data URIs are considered Cross Origin:
<object data="data:text/html,<script>alert(window.parent.document.cookie)</script>"></object>
The above example will result in: "Uncaught DOMException: Permission denied to access property "document" on cross-origin object". Furthermore, this also means that any payload an attacker were to put in an <object>
via the Data URI will not have access to the parent window's DOM. So, with that in mind, the only thing I can think of that an attacker could utilize this for is to embed a malicious form of some sort to try to capture user credentials: but that can be achieved by embedding mere HTML into data object, thus requiring no JS. I keep seeing in XSS cheatsheets a reference to this kind of attack, but where's the XSS side of this? Sure, I could embed whatever HTML I want in the object tag, but the JS part of it would only be for mere animations (and not XSS), no? Wouldn't it just be a way for an attacker to embed their own HTML to capture credentials? Is that the whole point or am I missing something?