Slashdot Mirror
Cross-Site Scripting Enabled On 1000 Major Sites (thestack.com)
An anonymous reader writes: A CloudFlare engineer has discovered that 1000 of the top one million websites, including bitcoin holding sites and trading sites, are running a default setting that enables cross-site scripting. This article details his examination of the top 1 million Alexa sites for evidence of compromised settings and finds that about 1000 of the sites on the list are capable of being compromised because of running a header called Access-Allow-Origin. He found the vulnerability while working on a legitimate use of domain-communication called Cross Origin Resource Sharing for the Stripe API. The header, which Johnson claims the vulnerable websites are outputting, is concluded with a wild-card asterisk, meaning that the sites in question are giving full permission for cross-domain communication via venerable protocols such as SOAP/AJAX XML exchanges.
Bad summary, as usual. Access-Control-Allow-Origin: * explicitly forbids requests with credentials. Even if the host reflects the Origin domain in the Access-Control-Allow-Origin header, it must also send Access-Control-Allow-Credentials: true to be vulnerable.
https://annevankesteren.nl/2012/12/cors-101
I told you to stop picking on us! Leave Slashdotters alone! Leave them alooooone! /cry
Why are we trusting site X as to whether we should load XSS from it. Or better yet, why not just deny third-party scripts.
Your ad here. Ask me how!
I can't read TFA due to work blockage. The summary makes it sounds as if he discovered a vulnerability, analyzed a bunch of sites for it, then published a list of the vulnerable sites along with details of the vulnerability.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
So, we are saying that .1% of web sites have this vulnerability?
And this is news?
Also the poster is worried about bitcoin, which has bigger problems than XSS?
lol
> built around one of the worst programming languages around (JavaScript),
. /sarcasm But it such as bastion of good design. *snicker* You mean it being written in 10 days wasn't long enough? :-)
"JavaScript: Designing a Language in 10 Days" aka Javascript: 10 days for the designer, 10 years of frustrations about fucked up design for devs
* http://www.computer.org/csdl/m...
As Douglas Crockford, inventor of JSON, said about Automatic Semi-Colon Insertion
And about amateurs
But let's keep relying on stupid shit such as this hack to turn on type safety:
*facepalm*
--
Why do the two shittiest languages, PHP and Javascript, power the web??
Another reason to run NoScript, which blocks these kinds of shenanigans.
That's a very large net to catch a not so sensational number. Look at it another way: that's 99.9% of the top one million websites *don't* "run a default setting that allows cross-site scripting".
Seriously, "top one million" means they're trawling pretty far down the pool to find these idiots.
Step away from the keyboard and stop giving security advice! That header lets any site load any content from that site, so if you are logged into with-header.example.com and you're looking at bigbadwolf.example, then bigbadwolf.example can impersonate you on with-header.example.com, because it can use your logged-in browser to access with-header.example.com, instead of accessing only the public information that it could get by accessing it from the server of bigbadwolf.example.
Also vendor SDKs that are loaded from their canonical sources, etc...
The problem is that Access-Allow-Origin cannot hold multiple value, which pushes developers to use * so that it works with more than one site
The right solution is to read the requester site name and return the Access-Allow-Origin header with it if it is in a whitelist. But that require a few extra line of coding.
There actually isn't any problem here, as all these sites are just as vulnerable to direct attacks irrelevant of the XSS headers. XSS only protects users which load data from suspicious websites, and those websites intend to make malicious calls to the vulnerable ones. Oh, did I mentioned the user has to be still logged in. This is nothing new, and why most browser default configuration is to prevent XSS. As a matter of fact XSS is required for all those social media APIs little icons to actually function, it isn't a vulnerability, it's a feature, and a useful one at that.
If you have to examine a million sites to find 1000 with that vulnerability, not only should you be trumpeting the fact that "...99.9% of the web is safe from this particular attack vector" (which doesn't sound NEARLY as inflammatory or click-baity) but you are also using a much broader definition of "major" in describing those websites.
I'd be willing to bet that once you get below the top 1000 on Alexa not many people consider anything in the rest of the "top 1,000,000 web sites" as "MAJOR".
Given that the web is an interconnected place, it isn't unreasonable to use resources from other hosts. That's been going on since at least '95. Sigh. Your objection is companies are using that to track you, allowing them to pay slashdot and others to keep websites running.
. Define sqrt(x) as something really evil like (x / rand()), and bury it deep. Watch your coworkers go nuts.