Forest Global Training Partners

Cyber Risks · PortSwigger Research

Document domain manipulation (reflected DOM-based)

Summary: Reflected DOM-based document domain manipulation occurs when data from a request is echoed into the immediate response in a part of the DOM that a client-side script processes unsafely, letting an attacker use controllable data to set the document.domain property. Because browsers use document.domain to enforce the same origin policy, two pages from different origins that set the same value can interact without restriction, and PortSwigger notes browsers allow child or parent domains and that some quirks permit switching to unrelated domains.

Bottom line: PortSwigger rates the severity as not far behind regular XSS, since an attacker who gets a targeted page and a page they control to share a document.domain value can fully compromise the targeted application page. Burp Scanner flags this through static analysis that can produce false positives, so without dynamic evidence someone has to review the code and execution paths to confirm whether the vulnerability is real or mitigated.

Read the original at PortSwigger Research ↗

Topics
Vulnerabilities & Patching
Related