3

Static resources and their caching interests me from the security perspective. Let's say we have an .jpg file requisted from the origin -> going through a reverse proxy with caching -> reaching the browser (and is also cached).

What attack vectors can be exploited here (assuming all possible misconfigurations of the server, errors in the code and such).

4

Here are some issues about static resources (SR) that I can think of:

  • SR that are not served via HTTPS in combination with cookies that don't have the Secure flag will leak the respective sensitive cookies and also cause browser warnings

  • JS resources that are not served via HTTPS can be modified by an attacker with a privileged network position and can be made to be stored and used on the client for a long time

  • JavaScript SRs can have vulnerabilities like XSS, DOM XSS and open redirects. Most old JS libraries introduce vulnerabilities.

  • Flash files can also be vulnerable to XSS, open redirects and others like HTML injection and Cross Site Flashing

  • Leftover SRs can leak information and indicate the version of a framework

  • Unlinked SRs can leak sensitive information if the attacker can guess its name. ex: 2010_price_offer.jpg, final_offer.jpg vs draft_offer.jpg

  • SRs with predictable names and no proper authorisation can leak information. ex: profile_picture10.jpg, profile_picture11.jpg, profile_picture12.jpg, etc

  • Verbose errors when accessing static resources or invalid resources can leak info such as internal paths and webservers used

  • A SR that is available only to a logged-in user can leak if the user is logged-in or not. See http://www.tomanthony.co.uk/blog/detect-visitor-social-networks/

  • A large-ish resources can be targeted in a denial-of-service attack. Imagine including a large 10-20 MB picture from the targeted server in a high traffic website.

  • If a SR is controlled by the attacker then it opens the door to all kinds of vulnerabilities

    • resources can be made to look like an image and also be something else. ex: Gifar
    • if the server doesn't specify a content type of the SR, some browsers will attempt to guess it and be manipulated
    • etc.
  • 1
    Good answer! One other to consider is DOM based XSS – paj28 Aug 3 '15 at 12:00
  • 1
    If you are talking about vulnerable JS libraries leading to DOM XSS, then yes, and I should edit my answer to make it more clear. Otherwise, I don't know of any DOM XSS on static resources. Please share the details if you do. – Cristian Dobre Aug 3 '15 at 15:30
  • 1
    Just JavaScript files, but it could be any JS file, not just libraries. e.g. using URL fragment with document.write – paj28 Aug 3 '15 at 21:41
  • 1
    Right, I shouldn't call all js a library. Similarly, there are vulnerable flash components, like video players. – Cristian Dobre Aug 3 '15 at 21:47
  • 2
    Oh yeah, there's crossdomain.xml too – paj28 Aug 3 '15 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.