The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE.

Is it possible for an attacker to steal the token, using javascript or flash, in the following example? How?

<!DOCTYPE html>
<html>
    <body>
         <embed id="foo" src="https://example.com/auth"></embed>
         <!-- Remember that example.com/auth will be automatically redirected to example.com/signed_in.SWF?token=SENSITIVE -->

         <!-- The code to steal the token value must go here -->

    </body>
</html>

Consider that:

  1. The above .html is hosted in cross-domain.com, just like any other file involved in the "solution" (.swf, .js, .html, .css, etc.);
  2. You do not have control over example.com;
  3. You do not have control over signed_in.SWF;
  4. You can change the <embed> tag to <object> or <iframe>;
  • 2
    Just to clarify, you're saying that any request that hits example.com/auth will return a 302 redirect to a URL that contains the sensitive token? – Nic Barker Aug 29 '15 at 2:47
  • 1
    @NicBarker Sorry, I was not clear enough. My fault. No, you need to be authenticated, so the server will check your cookies. – user61429 Aug 29 '15 at 3:10
  • 1
    I would appreciate any help about this question. – user61429 Sep 3 '15 at 3:49

If the user is authenticated and an attacker manages to use some kind of exploit to inject javascript (or flash) into the page, then yes, the attacker will be able to steal the secret token. They simply make a request using AJAX to the /auth endpoint and read the redirect URL that comes back. This was made possible recently by the addition of the responseURL parameter to XHR requests. They can then do with the token as they wish.

To avoid this, you could use some method of sending back the token that javascript and flash can't access (such as setting an HTTPOnly cookie). That way, the attacker can make requests all they want to the endpoint, but they won't be able to access the cookie using javascript.

If you need the token to be readable by your javascript, then you've got a bit more of a tricky problem.

  • 1
    Hey @NicBarker, thanks for your answer. I am considering that example.com has no vulnerabilities, as XSS, etc. Can you think in another way that an attacker can use to steal the token (using javascript or flash in a third-party domain)? – user61429 Aug 31 '15 at 3:06

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.