Cross-Origin JavaScript Capability Leaks: Detection, Exploitation, and Defense

Cross-Origin JavaScript Capability Leaks: Detection, Exploitation, and Defense

Cached

Download Links

by Adam Barth , Joel Weinberger , Dawn Song

Citations:

BibTeX

@MISC{Barth_cross-originjavascript,
    author = {Adam Barth and Joel Weinberger and Dawn Song},
    title = {Cross-Origin JavaScript Capability Leaks: Detection, Exploitation, and Defense},
    year = {}
}

OpenURL

Abstract

We identify a class of Web browser implementation vulnerabilities, cross-origin JavaScript capability leaks, which occur when the browser leaks a JavaScript pointer from one security origin to another. We devise an algorithm for detecting these vulnerabilities by monitoring the “points-to ” relation of the JavaScript heap. Our algorithm finds a number of new vulnerabilities in the opensource WebKit browser engine used by Safari. We propose an approach to mitigate this class of vulnerabilities by adding access control checks to browser JavaScript engines. These access control checks are backwardscompatible because they do not alter semantics of the Web platform. Through an application of the inline cache, we implement these checks with an overhead of 1–2 % on industry-standard benchmarks. 1

Keyphrases

cross-origin javascript capability leak implementation vulnerability javascript pointer industry-standard benchmark points-to relation javascript heap access control new vulnerability javascript engine web platform security origin inline cache opensource webkit browser engine access control check