41

I've recently seen XSSI mentioned on multiple pages, e.g. Web Application Exploits and Defenses:

Browsers prevent pages of one domain from reading pages in other domains. But they do not prevent pages of a domain from referencing resources in other domains. In particular, they allow images to be rendered from other domains and scripts to be executed from other domains. An included script doesn't have its own security context. It runs in the security context of the page that included it. For example, if www.evil.example.com includes a script hosted on www.google.com then that script runs in the evil context not in the google context. So any user data in that script will "leak."

I fail to see what kind of security problems this creates in practice. I understand XSS and XSRF but XSSI is a little mysterious to me.

Can anybody sketch an exploit based on XSSI?

Thanks

2

3 Answers 3

54

This is typically a problem if you are using JSONP to transfer data. Consider a website consisting of a domain A that loads data from domain B. The user has to be authenticated to site A and B, and because the Same Origin Policy prevents older browsers from communicating directly with a different domain (B) than the current page (A), the developers decided to use JSONP. So site A includes a script pointing to http://B/userdata.js which is something like:

displayMySecretData({"secret":"this is very secret", ...})

So A defines a function called displayMySecretData, and when the included script from server B runs, it calls that function and displays the secret data to the user.

Now evil server E comes along. It sees that A is including data from B using JSONP. So server E includes the same script, but defines its own displayMySecretData which instead steals the data. The attacker then tricks the user into visiting his site. When the user goes there and he is logged in to B, the browser automatically sends the authentication cookies for B along with the request to fetch the script from B. B sees an authenticated user, and thus returns the script as expected. E gets the data, and presto...

Using JSONP to load confidential data from a different domain this way is thus really insecure, but people are still using it. Bad idea!

3
  • 2
    This isn't the only way this exploit can work, but it's good as far as it goes.
    – zwol
    Aug 14, 2012 at 4:02
  • It doesn't seem clear how E suddenly came into the picture. How was it introduced? Can someone clarify?
    – Sam Sirry
    Sep 22, 2020 at 22:21
  • E is set up by the attacker on a hostname of their choice.
    – Erlend
    Sep 23, 2020 at 8:50
24

XSSI is not limited to jsonp responses. In some browsers you can override the Array constructor. If a Json response contains [...] and you include it as a script it will execute the new constructor instead of the builtin one. The fix is to insert something in the response that can't be parsed like ])}while(1);</x> and then use code to remove it before parsing it. An attacker can't do that since script inclusion is always the entire script.

More detail on the problem and this solution at http://google-gruyere.appspot.com/part3#3__cross_site_script_inclusion

2
  • > In some browsers That's the key part, only ancient browsers are vulnerable in this case. Plus, if your JSON is always an object at the root, it's not vulnerable.
    – Jon Abrams
    Jul 23, 2020 at 21:08
  • This answer is many years old and all browsers have been patched at this point. True. No one ever runs old browsers. False. People still run Windows XP and it's been at end of life and unpatched for years. As are the browsers on those systems. Implementing the advice here is harmless if the user's browser is up to date. (And re: "an object at the root" is not vulnerable, in Javascript [] instanceof Object. The Json definition ignores convention and refers to what most people call a map or dictionary as "object." I try to avoid that usage since it's easy for people to misunderstand.)
    – Vroo
    Jul 25, 2020 at 1:30
2

XSSI is a fancy way of saying: you are including in your program, someone elses code; You don't have any control over what is in that code, and you don't have any control over the security of the server on which it is hosted.

For example, let's say i include in my html page

<script type="text/javascript" src="http://mymatedave.com/js/coolwidget.js"></script>

That script will run in my webapp with the same level of trust as any of my own javascript code. It will have access to the the full page content and DOM, it will be able to read all my app's cookies and read the users keypresses and mouse movements, and everything else that javascript can do.

If my mate dave, then decides to put something malicious in his cool widget (say, a sniffer/keylogger that sends all the user's cookies, form data and keypresses to his server) then I won't necessarily know. Also, the security of my app now depends on the security of dave's server. If dave's server gets compromised and coolwidget.js is replaced by the attacker, i again won't necessarily know and the malicious code will run as part of my app.

2
  • 17
    This is all true, but it's not what people mean when they say XSSI. In XSSI, the page that includes the script is malicious, the script itself is the victim. Erlend's answer is accurate (as far as it goes; it only covers one of the ways to exploit a JavaScript file containing confidential information).
    – zwol
    Aug 14, 2012 at 4:01
  • 1
    The vulnerability known as cross-site script inclusion (XSSI) is a cross-site attack meant to exfiltrate sensitive data from scripts served by the target site to its authenticated users. This answer is not about XSSI.
    – jub0bs
    Feb 1, 2020 at 16:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.