4 ms·
Isn't the JS exfiltration part trivial? The attack assumes that the victim is visiting an attacker-controlled web server. If the attacker can put secret data
by mtlynch 3y ago
Isn't the JS exfiltration part trivial?
The attack assumes that the victim is visiting an attacker-controlled web server.
If the attacker can put secret data in the DOM within the victim's browser, the attacker can also add JS on the same page that POSTs the DOM contents to the server once they're populated with secrets.
- userbinator 3y agoIf it's "trivial", then perhaps the article should've demonstrated that.
- tsimionescu 3y agoIf I prove I got a shell prompt on a remote device without any authentication, do I then need to show that I can execute arbitrary code? Or is it clearly implied? If the page body can read a file, then it can just execute an XmlHttpRequest to send that data to the origin server, which is the attacker in this scenario. This is just how the web works, nothing more to say about it, and no need to prove it.
- userbinator 3y agoIt's not necessarily true that what can be read locally can be sent to a remote server.
- tsimionescu 3y agoIt very much is on the web, if you are sending it to the origin server.
- fulafel 3y agoVulnerabilitity research without doing the work to productize exploits is good and productive, let's not normalize the opposite expectation. It's a chilling effect.