Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Researcher Details New Class Of Cross-Site Scripting Attack

'Meta-Information XSS' exploits commonly used network administration utilities

A new type of cross-site scripting (XSS) attack that exploits commonly used network administration tools could be putting users' data at risk, a researcher says.

Tyler Reguly, lead security research engineer at nCircle, today published a white paper outlining a new category of attack called "meta-information XSS" (miXSS), which works differently than other forms of the popular attack method -- and could be difficult to detect.

"Think about those network administration utilities that so many webmasters and SMB administrators rely on -- tools that perform a whois lookup, resolve DNS records, or simply query the headers of a Web server," the white paper states. "They're taking the meta-information provided by various services and displaying it within the rendered Website.

"These Web-based services introduce a class of XSS that can't be captured by the current categories."

Reguly explains that there are three current types of XSS attacks: reflected, persistent, and DOM-based.

"Reflected XSS refers to an attack that occurs when user input is reflected back at the user," he writes. "This means that you provide the malicious data as user input, and the Web application simply echoes the data back to you.

"Persistent XSS refers to an attack that stores user input, allowing it to affect a much broader scope of visitors. An attack may be stored in the database and displayed to all visitors, rather than just the visitor that provided the malicious input."

DOM-based XSS refers to attacks that modify the Document Object Model directly and don't require data in the HTTP response, Reguly says.

"None of these [categories] really captures the process that occurs when you are dealing with [miXSS]," the paper says. "With miXSS, the input that the user provides is completely valid and properly sanitized. This rules out reflected XSS, and since we aren't storing the user input, persistent XSS can also be disregarded. Finally, since we're not interacting with the DOM, we can eliminate this type of attack."

MiXSS has aspects of both reflected and persistent attacks, but does not fall into either category, Reguly explains. "It is valid user input provided to a service," he says. "The service then utilizes the user-provided data to gather data and display it for the user. It is in this data that the cross-site scripting occurs." Reguly offers an example: a DNS TXT record that contains [a certain value] and a service designed to gather DNS TXT records for the purpose of testing sender policy framework (SPF) records.

"The user provides the domain name pointing to the TXT record, while the service resolves the TXT data and displays the data to the user," the paper says. "Since the data contains JavaScript, the returned data is processed, and successful cross-site scripting has occurred."

The XSS vulnerability could be a growing threat in the future, Reguly says, because Web-based tools such as these are increasingly used to quickly resolve network administration issues that might otherwise inhibit the user experience, the paper says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Florida Town Pays $600K to Ransomware Operators
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/20/2019
Pledges to Not Pay Ransomware Hit Reality
Robert Lemos, Contributing Writer,  6/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12949
PUBLISHED: 2019-06-25
In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diag_command.php and rrd_fetch_json.php (timePeriod parameter), to a server. Then, the remot...
CVE-2019-12957
PUBLISHED: 2019-06-25
In Xpdf 4.01.01, a buffer over-read could be triggered in FoFiType1C::convertToType1 in fofi/FoFiType1C.cc when the index number is larger than the charset array bounds. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It allows an attacker to use a crafted pd...
CVE-2019-12958
PUBLISHED: 2019-06-25
In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in FoFiType1C::convertToType0 in fofi/FoFiType1C.cc when it is trying to access the second privateDicts array element, because the privateDicts array has only one element allocated.
CVE-2019-12951
PUBLISHED: 2019-06-24
An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow.
CVE-2019-10689
PUBLISHED: 2019-06-24
VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and earlier provides insufficient authentication between the BToE application and the BToE component, resulting in leakage of sensitive information.