Web Browser Extension User-Script XSS Vulnerabilities
| Autor: | Muath Obaidat, Joseph Brown, Abdullah Al Hayajneh |
|---|---|
| Rok vydání: | 2020 |
| Předmět: |
021110 strategic
defence & security studies Scrutiny Exploit Computer science Cross-site scripting 0211 other engineering and technologies Vulnerability 02 engineering and technology Extension (predicate logic) Computer security computer.software_genre JavaScript Browser security 0202 electrical engineering electronic engineering information engineering 020201 artificial intelligence & image processing Plug-in computer computer.programming_language |
| Zdroj: | DASC/PiCom/CBDCom/CyberSciTech |
| DOI: | 10.1109/dasc-picom-cbdcom-cyberscitech49142.2020.00062 |
| Popis: | Browser extensions have by and large become a normal and accepted omnipresent feature within modern browsers. However, since their inception, browser extensions have remained under scrutiny for opening vulnerabilities for users. While a large amount of effort has been dedicated to patching such issues as they arise, including the implementation of extension sandboxes and explicit permissions, issues remain within the browser extension ecosystem through user-scripts. User-scripts, or micro-script extensions hosted by a top-level extension, are largely unregulated but inherit the permissions of the top-level application manager, which popularly includes extensions such as Greasemonkey, Tampermonkey, or xStyle. While most user-scripts are docile and serve a specific beneficial functionality, due to their inherently open nature and the unregulated ecosystem, they are easy for malicious parties to exploit. Common attacks through this method involve hijacking of DOM elements to execute malicious javascript and/or XSS attacks, although other more advanced attacks can be deployed as well. User-scripts have not received much attention, and this vulnerability has persisted despite attempts to make browser extensions more secure. This ongoing vulnerability remains an unknown threat to many users who employ user-scripts, and circumvents security mechanisms otherwise put in place by browsers. This paper discusses this extension derivative vulnerability as it pertains to current browser security paradigms. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|