Code-Reuse Attacks for the Web: Breaking Cross-Site Scripting Mitigations via Script Gadgets
Code-Reuse Attacks for the Web: Breaking Cross-Site Scripting Mitigations via Script Gadgets
复制标题
Web 代码重用攻击：通过脚本小工具打破跨站点脚本缓解措施
DOI：
10.1145/3133956.3134091
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
Martin Johns
中科院分区：
文献类型：
--
作者：
Sebastian Lekies;Krzysztof Kotowicz;Samuel Groß;E. Nava;Martin Johns
跨站点脚本（XSS）是Web上一个经久不衰的问题。从2000年最初的公开文档到现在，XSS一直处于漏洞统计数据的首位。尽管已经有相当多的研究和开发人员培训在源代码级别解决XSS问题，但发现的XSS问题的总数仍然很高。正因为如此，人们提出了各种缓解XSS的方法作为第二道防线，其中HTML杀毒器、Web应用程序防火墙、基于浏览器的XSS过滤器和内容安全策略是一些突出的例子。这些机制大多关注脚本标记和事件处理程序，要么从用户提供的内容中删除它们，要么阻止它们的脚本代码执行。在本文中，我们证明了这种方法不再适用于现代应用程序：我们描述了一种新的Web攻击，它可以绕过所有这些当前存在的XSS缓解技术。在这种攻击中，攻击者滥用所谓的脚本小工具（应用程序合法代码库中的合法JavaScript片段）来执行JavaScript。在大多数情况下，这些小工具利用DOM选择器与Web文档中的元素进行交互。通过初始注入点，攻击者可以注入看似无害的HTML元素，这些元素被这些缓解技术忽略，但与小工具的选择器匹配。通过这种方式，攻击者可以劫持小工具的输入并处理其输入，从而导致执行攻击者控制的值的代码。我们展示了这些小工具在几乎所有现代JavaScript框架中无处不在，并提供了一项实证研究，显示了脚本小工具在生产代码中的流行。因此，我们假设今天编写的web应用程序中的大多数缓解技术都可以被绕过。
Cross-Site Scripting (XSS) is an unremitting problem for the Web. Since its initial public documentation in 2000 until now, XSS has been continuously on top of the vulnerability statistics. Even though there has been a considerable amount of research and developer education to address XSS on the source code level, the overall number of discovered XSS problems remains high. Because of this, various approaches to mitigate XSS have been proposed as a second line of defense, with HTML sanitizers, Web Application Firewalls, browser-based XSS filters, and the Content Security Policy being some prominent examples. Most of these mechanisms focus on script tags and event handlers, either by removing them from user-provided content or by preventing their script code from executing. In this paper, we demonstrate that this approach is no longer sufficient for modern applications: We describe a novel Web attack that can circumvent all of theses currently existing XSS mitigation techniques. In this attack, the attacker abuses so called script gadgets (legitimate JavaScript fragments within an application's legitimate code base) to execute JavaScript. In most cases, these gadgets utilize DOM selectors to interact with elements in the Web document. Through an initial injection point, the attacker can inject benign-looking HTML elements which are ignored by these mitigation techniques but match the selector of the gadget. This way, the attacker can hijack the input of a gadget and cause processing of his input, which in turn leads to code execution of attacker-controlled values. We demonstrate that these gadgets are omnipresent in almost all modern JavaScript frameworks and present an empirical study showing the prevalence of script gadgets in productive code. As a result, we assume most mitigation techniques in web applications written today can be bypassed.