The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

can only be used to issue requests to the same domain as the page that is

invoking it. Without this restriction, Ajax could be used to trivially violate the

browser’s same origin policy, by enabling applications to retrieve and process

data from a different domain.

Chaining XSS and Other Attacks

XSS flaws can sometimes be chained with other vulnerabilities to devastating

effect. The authors encountered an application that had a stored XSS vulnera-

bility within the user’s display name. The only purpose for which this item

was used was to show a personalized welcome message after the user logged

in. The display name was never displayed to other application users, so there

initially appeared to be no attack vector for users to cause problems by editing

their own display name. Other things being equal, the vulnerability would be

classified as very low risk.

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 390

---

However, a second vulnerability existed within the application. Defective

access controls meant that any user could edit the display name of any other

user. Again, on its own, this issue had minimal significance: Why would an

attacker be interested in changing the display name of other users?

Chaining these two low-risk vulnerabilities together enabled an attacker to

completely compromise the application. It was trivial to automate an attack 

to inject a script into the display name of every application user. This script

executed every time a user logged in to the application, and transmitted the

user’s session token to a server owned by the attacker. Some of the applica-

tion’s users were administrators, who logged in frequently and had the abil-

ity to create new users and modify the privileges of other users. An attacker

simply had to wait for an administrator to log in, hijack the administrator’s

session, and then upgrade their own account to have administrative privi-

leges. The two vulnerabilities together represented a critical risk to the secu-

rity of the application.