Forest Global Training Partners

Cyber Risks · PortSwigger Research

Cross-site scripting (stored DOM-based)

Summary: Stored DOM-based cross-site scripting occurs when user input is stored and later embedded in a response inside a part of the DOM that a client-side script processes unsafely, letting an attacker control data such as a JavaScript string that triggers the DOM-based flaw. PortSwigger notes that an attacker can construct a URL which, when visited by another user, executes attacker-supplied JavaScript in that user's browser session, enabling theft of session tokens or login credentials, arbitrary actions on the victim's behalf, and keystroke logging.

Key Takeaway: The payload executes inside the victim's authenticated session, so a single crafted URL can hand over session tokens or credentials and let an attacker act as that user. PortSwigger also warns that static analysis alone produces false positives, so a finding without dynamic evidence has to be confirmed against the code and execution paths before it is trusted.

Read the original at PortSwigger Research ↗

Topics
Vulnerabilities & Patching
Related