Cross site scripting and the use of http-only cookies?

Question

I have been a developer and now I am trying to look at XSS from the point of view of a developer. I was thinking of a particular case of reflected XSS . Let us say we have a vulnerable website and if an attacker can trick the users to click on a malicious link he can get their session tokens by using document.cookie

I was wondering that if the website starts to use http-only cookies (I suppose this will make it impossible to access the session tokens by the use of JavaScript. Am I missing out a point?) but still remains vulnerable to script injection in such a case what are the options left for the attacker? What are the other ways of exploiting this vulnerability?

Answer 1

There are two major attack patterns that can be explored by an attacker armed with an XSS vulnerability that affects an application that uses HTTPOnly cookies.

First and foremost an attacker can use an exploitation method similar to the Sammy worm. In this attack pattern the XSS payload uses an XMLHttpRequest to read a CSRF token and perform an action as if they where the victim. Common actions would be, adding a new administrative user, changing your password (or email address to perform a password reset) or even transfer funds. Any action that the authenticated session can perform, you should be able to perform with JavaScript by reading CSRF tokens.

The second attack is leveraging a trusted domain. Lets say the target is https://sometrustedbank.com. That HTTPS looks pretty shinny to informed users, but an attacker can modify any content on this page by assigning document.body.innerHTML to any value. An attacker could conduct a very convincing phishing attack where by a helpless victims are directed to https://sometrustedbank.com and asked to divulge personal information (and deep dark secrets). In this case the content is king, and a user is unaware that this content originates from an attacker.

In short; enable HTTPOnly Cookies, but know that this security feature was never indented to stop XSS.