Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Researcher Details New Class Of Cross-Site Scripting Attack

'Meta-Information XSS' exploits commonly used network administration utilities

A new type of cross-site scripting (XSS) attack that exploits commonly used network administration tools could be putting users' data at risk, a researcher says.

Tyler Reguly, lead security research engineer at nCircle, today published a white paper outlining a new category of attack called "meta-information XSS" (miXSS), which works differently than other forms of the popular attack method -- and could be difficult to detect.

"Think about those network administration utilities that so many webmasters and SMB administrators rely on -- tools that perform a whois lookup, resolve DNS records, or simply query the headers of a Web server," the white paper states. "They're taking the meta-information provided by various services and displaying it within the rendered Website.

"These Web-based services introduce a class of XSS that can't be captured by the current categories."

Reguly explains that there are three current types of XSS attacks: reflected, persistent, and DOM-based.

"Reflected XSS refers to an attack that occurs when user input is reflected back at the user," he writes. "This means that you provide the malicious data as user input, and the Web application simply echoes the data back to you.

"Persistent XSS refers to an attack that stores user input, allowing it to affect a much broader scope of visitors. An attack may be stored in the database and displayed to all visitors, rather than just the visitor that provided the malicious input."

DOM-based XSS refers to attacks that modify the Document Object Model directly and don't require data in the HTTP response, Reguly says.

"None of these [categories] really captures the process that occurs when you are dealing with [miXSS]," the paper says. "With miXSS, the input that the user provides is completely valid and properly sanitized. This rules out reflected XSS, and since we aren't storing the user input, persistent XSS can also be disregarded. Finally, since we're not interacting with the DOM, we can eliminate this type of attack."

MiXSS has aspects of both reflected and persistent attacks, but does not fall into either category, Reguly explains. "It is valid user input provided to a service," he says. "The service then utilizes the user-provided data to gather data and display it for the user. It is in this data that the cross-site scripting occurs." Reguly offers an example: a DNS TXT record that contains [a certain value] and a service designed to gather DNS TXT records for the purpose of testing sender policy framework (SPF) records.

"The user provides the domain name pointing to the TXT record, while the service resolves the TXT data and displays the data to the user," the paper says. "Since the data contains JavaScript, the returned data is processed, and successful cross-site scripting has occurred."

The XSS vulnerability could be a growing threat in the future, Reguly says, because Web-based tools such as these are increasingly used to quickly resolve network administration issues that might otherwise inhibit the user experience, the paper says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
A Lawyer's Guide to Cyber Insurance: 4 Basic Tips
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  7/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10100
PUBLISHED: 2019-07-18
Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access ...
CVE-2019-10100
PUBLISHED: 2019-07-18
domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change admin password. The component is: http://127.0.0.1/settings/password/ http://127.0.0.1/admin/users/add.php http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector ...
CVE-2019-10100
PUBLISHED: 2019-07-18
domainmod(https://domainmod.org/) domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can add the administrator account. The component is: http://127.0.0.1/admin/users/add.php. The attack vector is: After the administrator logged in,...
CVE-2019-10100
PUBLISHED: 2019-07-18
domainmod(https://domainmod.org/) domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change the read-only user to admin. The component is: http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector is: After the administrato...
CVE-2016-10762
PUBLISHED: 2019-07-18
The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used.