Cross-Domain Communication

  • Focus: Cross-domain Network Communication
  • Problem:
    • XMLHttpRequest initially used the SOP
    • SOP often too restrictive for this use case
    • e.g., authentication backend at a different origin, data on different servers
  • How to perform cross-domain requests?
    • Adobe Flash
    • JSONP
    • Cross-Origin Resource Sharing (see Policies)

Adobe Flash

  • Allows cross-domain communication
  • Includes all cookies for requests
  • Flash does not inherit origin
    • e.g., Flash from a.com can create requests to a.com (with cookies) if included on b.com
  • Remote server must allow communication
    • Only for remotes with other origins (not the Flash-providing origin)
    • List of allowed hosts
    • Config file: crossdomain.xml
    • First, config file is fetched from remote server
  • 2016: Used by 8 % of sites

../_images/03-flash.png

JSONP

  • JSON with Padding
  • Use Case:
    • Script wants to load resource from remote host (e.g., JSON data)
  • Problem:
    • SOP prohibits reading resources from other origins
    • Idea: Embed external resource (allowed by SOP)
    • Loading JSON in <script> tag is allowed but not accessible to other scripts in the browser
  • Solution:
    • Wrap JSON data in function call (also called padding)
    • Script is executed in including scope
  • Example:
    • Site: <script src="example.org/resource.json?callback=myfunc"/>
    • Server-Response: myfunc(<data>)

Functionality

  • Remote server wraps JSON data in function
    • Alternative: Create global variable
  • Function must be defined in browser scope/client side
  • Function name is supplied as GET parameter in URL
  • Script element injection: Add <script> element to request the JSONP-data
  • Example:
    • Request: example.org/user.json?callback=func
    • Response: func({...})

Disadvantages

  • Dirty hack
  • Remote server: Hard to ensure that allowed clients can access data
    • e.g., Referer header can be stripped (by using data: URLs)
  • Execute remote script (Attacker can change response/inject code)
  • Remote server can compromise requesting client

Rosetta Flash Attack

  • Combination of JSONP and Flash
  • Attack scenario:
    • Attacker wants to steal sensitive information from a vulnerable target site (e.g., Google)
    • Target site provides JSONP interface
    • Attacker controls some web-server
    • Attacker embeds a call to the JSONP interface of the vulnerable target site in his web server
  • Attack:
    • JSONP callback contains malicious Flash file which extracts sensitive information from the user account of the victim
    • The Flash file can send cookie-carrying requests to the target site (because the Flash comes from there)
  • Vulnerability:
    • JSONP allows the attacker to control first bytes (callback)
    • JSONP only allows printable characters as callback
    • Attacker sets callback to malicious Flash file (using Huffman encoding and zlib)
    • Attacker includes this callback in his website (request JSONP interface of target site)
    • Victim’s browser accessing attacker’s website creates JSONP request and executes this received Flash
    • Problem: Flash does not inherit origin, so victim’s browser can send requests with cookies to target website and exfiltrate sensitive information
  • e.g., using <object type="application/flash"...>
  • More Information: Blog entry