XSSI (Cross-Site Script Inclusion)
Basic Information
XSSI designates a kind of vulnerability which exploits the fact that, when a resource is included using the script
tag, the SOP doesn’t apply, because scripts have to be able to be included cross-domain. An attacker can thus read everything that was included using the script
tag.
This is especially interesting when it comes to dynamic JavaScript or JSONP when so-called ambient-authority information like cookies are used for authentication. The cookies are included when requesting a resource from a different host.
Types
Static JavaScript (regular XSSI)
Static JavaScript, which is only accessible when authenticated
Dynamic JavaScript
Non-JavaScript
Regular XSSI
The private information is located inside a global accessible JS file, you can just detect this by reading files, searching keywords or using regexps. To exploit this, just include the script with private information inside the malicious content:
Dynamic-JavaScript-based-XSSI and Authenticated-JavaScript-XSSI
If the information resides inside a global variable, you you can exploit it using the same code as for the the previous case. If the confidential data is sent inside a JSONP response, you can override the executed function to retrieve the information:
Or you could also set a prepared function to be executed by the JSONP response:
In the original code slice
from type Array
accesses the data we’re interested in. An attacker can, as described in the preceding clause, override slice
and steal the secrets.
Non-Script-XSSI
JSON with UTF-7:
Including the JSON in the attacker’s page
Last updated