Researcher Details New Class Of Cross-Site Scripting AttackResearcher Details New Class Of Cross-Site Scripting Attack
'Meta-Information XSS' exploits commonly used network administration utilities
April 6, 2010
A new type of cross-site scripting (XSS) attack that exploits commonly used network administration tools could be putting users' data at risk, a researcher says.
Tyler Reguly, lead security research engineer at nCircle, today published a white paper outlining a new category of attack called "meta-information XSS" (miXSS), which works differently than other forms of the popular attack method -- and could be difficult to detect.
"Think about those network administration utilities that so many webmasters and SMB administrators rely on -- tools that perform a whois lookup, resolve DNS records, or simply query the headers of a Web server," the white paper states. "They're taking the meta-information provided by various services and displaying it within the rendered Website.
"These Web-based services introduce a class of XSS that can't be captured by the current categories."
Reguly explains that there are three current types of XSS attacks: reflected, persistent, and DOM-based.
"Reflected XSS refers to an attack that occurs when user input is reflected back at the user," he writes. "This means that you provide the malicious data as user input, and the Web application simply echoes the data back to you.
"Persistent XSS refers to an attack that stores user input, allowing it to affect a much broader scope of visitors. An attack may be stored in the database and displayed to all visitors, rather than just the visitor that provided the malicious input."
DOM-based XSS refers to attacks that modify the Document Object Model directly and don't require data in the HTTP response, Reguly says.
"None of these [categories] really captures the process that occurs when you are dealing with [miXSS]," the paper says. "With miXSS, the input that the user provides is completely valid and properly sanitized. This rules out reflected XSS, and since we aren't storing the user input, persistent XSS can also be disregarded. Finally, since we're not interacting with the DOM, we can eliminate this type of attack."
MiXSS has aspects of both reflected and persistent attacks, but does not fall into either category, Reguly explains. "It is valid user input provided to a service," he says. "The service then utilizes the user-provided data to gather data and display it for the user. It is in this data that the cross-site scripting occurs." Reguly offers an example: a DNS TXT record that contains [a certain value] and a service designed to gather DNS TXT records for the purpose of testing sender policy framework (SPF) records.
The XSS vulnerability could be a growing threat in the future, Reguly says, because Web-based tools such as these are increasingly used to quickly resolve network administration issues that might otherwise inhibit the user experience, the paper says.
Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.
About the Author(s)
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
AI in Cybersecurity: Using artificial intelligence to mitigate emerging security risks
Building Immunity: The 2021 Healthcare and Pharmaceutical Industry Cyber Threat Landscape Report
2021 Gartner Market Guide for Managed Detection and Response Report