Three major XSS issues in 2016

XSS vulnerability in Yahoo Mail
This year was really interesting in terms of real use-cases. One of the most recent findings was described by Jouko Pynnönen about a stored XSS vulnerability in Yahoo Mail. According to JP’s blog “The flaw was reported to Yahoo Security via HackerOne on November 12 and fixed on November 29, 2016. Yahoo awarded a bounty of $10,000 for the finding.” In short, an attacker could perform a DOM-based XSS attack via dynamically generated HTML markups controlled by user-supplied values that were not properly sanitized.
AngularJS
Another interesting issue was when the AngularJS team decided to remove their “expression sandbox” from AngularJS 1 after reporting escapes for all AngularJS 1 versions. It’s important to emphasize that this sandbox was never intended to provide real protection against XSS attacks. It rather misled developers who kept relying upon it as a security feature.
Javascript function overrides
There are other XSS mitigation techniques such as Javascript function overrides, but these also failed to provide long-term XSS protection. A recent blog entry on brutelogic.com suggests to use iframes to bypass the protection provided by “js-override.js”.
Practice with us!
You can see that XSS is still hot and it makes total sense to arm yourself against it. Try your skills again by solving our Avatao XmaSS challenge. Enjoy!
If you like our posts and challenges, follow us on Twitter and Facebook for the most recent updates.
We wish you a Merry Christmas!
Share this post on social media!
Related Articles
Best practices to prevent IDOR vulnerabilities
Learn about Insecure Direct Object Reference and the steps you can take as a developer to make sure your applications are safeguarded against cyberattacks.
Interview with Davide Balzarotti
Having the right security mindset is important, so we asked an expert about learning security and building security awareness!
Vulnerabilities in authentication and authorization
Authentication and authorization both can be associated with common security vulnerabilities. Here are some ways to prevent them!