Scenario:

Server-side script takes URL parameter parameter1 and writes it without encoding into cookie cookie1. Then regular HTML page containing client-side script is returned.

Client-side script, when user triggers an action, takes a value stored in cookie cookie1 and inserts it without any processing as HTML content of a paragraph.

How to classify this XSS? On one hand, payload reaches the server and server-side code can encode user supplied data before putting it into a cookie. On the other hand, insecure DOM manipulation is another reason of XSS occuring. Could you please clarify the distinction between reflected and DOM-based XSS on this particular example?

up vote 0 down vote accepted

DOM based if you're basing it on the stored/reflected/DOM classification system.

From OWASP Types of Cross-Site Scripting:

DOM Based XSS is a form of XSS where the entire tainted data flow from source to sink takes place in the browser, i.e., the source of the data is in the DOM, the sink is also in the DOM, and the data flow never leaves the browser.

Here the source of the data is document.cookie and the sink is also in the DOM (HTML content of a paragraph).

However, classifying XSS in such a way really only boils down to semantics, as the article notes:

For years, most people thought of these (Stored, Reflected, DOM) as three different types of XSS, but in reality, they overlap. You can have both Stored and Reflected DOM Based XSS.

Using the above I guess you could classify it as "Reflected DOM Based".

OWASP have attempted to try and get people to reclassify XSS as either server based or client based, where DOM XSS is a subset of Client XSS. Using this system it would be a "Reflected Client XSS" vulnerability.

Regardless of actual classification, the vulnerability here is in the DOM rather than the cookie storage as there is no need to HTML encode for storage into a cookie. Encoding should be done as late as possible when the usage context is known otherwise this cookie could have been poisoned.

e.g.

  1. Website is on example.com and it normally only listens on HTTPS.
  2. Attacker Man-In-The-Middles an HTTP connection from their victim and sends them to example.com over plain HTTP. The HTTP server in this case is the attacker's.
  3. Attacker sets the cookie containing some script code.
  4. The victim later visits the real example.com over HTTPS and the XSS is triggered.

As the code that adds the text to the DOM is not correctly HTML encoding, this is a DOM based XSS attack. As you can see from the above example, not HTML encoding on storage into the cookie doesn't stop the above attack scenario.

  • With reference to Step 2, when you say the HTTP server in this case is the attacker's i.e server B, how does he set the cookies for the original server A? Wouldn't same origin policy prevent that? Unless i am missing something. – Aatif Shahdad Jun 1 '15 at 15:16
  • The attacker is setting them on the same domain, using a fake example.com. The Same Origin Policy for cookies does not distinguish between http and https. – SilverlightFox Jun 1 '15 at 16:31
  • So, SOP as applicable to cookies allows an http:// version to set cookies for an https:// version? Isn't that a protocol failure as different protocols are treated as different origins or are cookies excused from these restrictions? Also, what is this attacked called where you serve a fake example.com, DNS spoofing? – Aatif Shahdad Jun 1 '15 at 18:10
  • Cookies use a separate definition of origins. The attack is just a Man-In-The-Middle. It could be achieved via ARP spoofing of the gateway on the local network. – SilverlightFox Jun 1 '15 at 19:25
  • Ah, thank you for the resource on Cookies. Very helpful. With reference to MITM, i dont think merely performing ARP spoofing will serve fake pages. I understand that would be the first step of the process to become the MITM, the second step being serving a fake example.com when the victim thinks he is connecting to the real one. – Aatif Shahdad Jun 2 '15 at 0:45

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.