DOM Injection Attacks

Besides the classic Cross-Site Scripting where the playload moves to the server and back, there is another form of user agent injection attacks, which does not depend on the payload to be embedded in the response, but rather on thepayload in the Document Object Model (DOM). The DOM is the standard object model in browsers to represent HTML documents and meta data in an object-oriented way, whichis provided to the JavaScript code. The most important object is the document object, which not only includes all elements from the HTML document, but also meta-objects,such as URL, URLUnencoded, location (also in window.location) or referrer, which contain the complete URL of the current document or the referring one, respectively. There aremany web applications that access the DOM, and a few parse the meta-objects mentioned above, which makes them vulnerable to DOM-based injection, as in http://www.webappsec.org/projects/articles/071105.html. Here is an example of avulnerable script, which is supposed to extract the user's name from the document's URL (by searching for "name=" and returning the string after it):

 

Hello <script> var pos = document.URL.indexOf("name=")+5;

document.write(document.URL.substring(pos,document.URL.length));
</script>

Do not think that everyone enters his real name like Joe or Alice, take a look at this user name:

http://www.domain.com/welcome?name=
<script>alert(document.cookie)</script>

And if the server filters the parameter name, then xyzname will not be filtered, but the script in the document will use the first occurence:

 

http://www.domain.com/welcome?xyzname=
<script>alert(document.cookie)</script>&name=Alice

 

Notice the number sign (#) here, it is usually used to refer to a part of a document and never sent to the server, so any server-side checks will have no effect, but the local script will use the malicious code nevertheless.

 

http://www.domain.com/welcome#name=
<script>alert(document.cookie)</script>

 

To be continued ... 

Comments

[James H]

Thank you again. Frankly I had only heard of this type of attack recently and find it quite intriguing.

[Two more great articles from t]

[...] If you're new here, you may want to subscribe to my RSS feed. Thanks for visiting!http://www.rorsecurity.info/2007/05/04/dom-injection-attacks/ [...]

[be debt free]

Lovely. Made my day (which is saying something)

[christian debt management secu]

What a nice site, been surfing on it for the whole night and day and i neva got bored for a single minute. Keep up your good work and all of the best in everything you do! :-)

[major credit reporting agencie]

This is a great web site. I have some great web pages myself if you are interested to share. But I should not go on about my site too much, that is not fair, right?

[construction loan]

Very exceptional pieces of information. Very nice webpage though. I applaud

[identity theft shield]

I just want you to know that I think you did a terrific job on this websight.

[chase platinum card citi card]

Howdy! Great site. Great content. Great! I can recommend this site to others!

[credit card ballance transfers]

Ich finde Ihre Homepage sehr gut und fundiert. Die Informationen helfen mir bei einer Diplomarbeit für den Bereich der Medizinischen Dokumentation vielen Dank und weiter so.

[guide]

perfect site !!!!!!!! Perfect piece of work fellows !!!!!!!

[countrywide home loans]

This is such a wonderful and informative way to reach others. I Will be more than glad to share this site

[cheap cod delaware phentermine]

I like your website I will share this with friends

[tablet]

Nice website. Great online affiliate program. Thank you.

[casino promotion]

I dont even remember how i reached your site but it doesnt matter, cause i'm so happy i found it, it really made me think, keep up the good work

[zyrtec d]

Thank you for opening a wonderfully new sight..I wish you the best of luck with your new venture.

[free casino games casino ratin]

Thank you for the great web site - a true resource, and one many people clearly enjoy

[hydrocodone prescription]

Lovely to see such a wonderful site. Thank you

[minority small business loans]

Just stopped by to visit and got the crunch on your stuff in here - bravo!

[insurance rates]

interesting site

[cash till payday]

Hi there, I must say that you have done a wonderful job on your site and I thoroughly enjoyed my stay here, I thank you for sharing it with me…