Jump to content

Self-XSS

From Wikipedia, the free encyclopedia

Self-XSS (self cross-site scripting) is a type of security vulnerability used to gain control of victims' web accounts. In a Self-XSS attack, the victim of the attack runs malicious code in their own web browser, thus exposing personal information to the attacker.[1]

Overview

[edit]
A Self-XSS attack warning on a browser's web developer console

Self-XSS operates by tricking users also into copying and pasting malicious content into their web browser. This includes both where a user copies a payload into an input, and in the web developer console.[1] Usually, the attacker posts a message that says by copying and running certain code, the user will be able to receive virtual rewards or hack a website. In fact, the code allows the attacker to hijack the victim's account.[2] Self-XSS usually has very low impact, however, chaining it with a cross-site request forgery vulnerability escalates its impact to that of typical cross-site-scripting.[3]

History and mitigation

[edit]

In the past, a very similar attack took place, in which users were tricked into pasting malicious JavaScript into their address bar. When browser vendors stopped this by preventing easily running JavaScript from the address bar,[4][5] attackers started using Self-XSS in its current form. Web browser vendors and web sites have taken steps to mitigate this attack. Firefox[6] and Google Chrome[7] have both begun implementing safeguards to warn users about Self-XSS attacks. Facebook and others now display a warning message when users open the web developer console, and they link to pages explaining the attack in detail.[8][9]

Etymology

[edit]

The "self" part of the name comes from the fact that the user is attacking themselves. The "XSS" part of the name comes from the abbreviation for cross-site scripting, because both attacks result in malicious code running on a legitimate site. However, Self-XSS has much less impact than most other XSS vulnerabilities because it relies on social engineering. Additionally, the risk of Self-XSS arising from using the web developer console cannot be eliminated by the site operator,[10] unlike other XSS vulnerabilities which can be solved.

References

[edit]
  1. ^ a b Scharr, Jill (July 28, 2014). "Facebook Scam Tricks Users Into Hacking Themselves". Tom's Guide US. Purch. Retrieved September 27, 2014.
  2. ^ "Social Networking Security Threats". Sophos. n.d. Retrieved September 27, 2014.
  3. ^ Stephens, Luke (2021-03-25). "The Ultimate Guide to Finding and Escalating XSS Bugs | @Bugcrowd". Bugcrowd. Retrieved 2024-10-04.
  4. ^ "Bug 656433 – Disallow javascript: and data: URLs entered into the location bar from inheriting the principal of the currently-loaded page". Bugzilla. Mozilla Foundation. May 11, 2011. Retrieved September 28, 2014.
  5. ^ "Issue 82181: [Linux] Strip javascript: schema from pastes/drops to omnibox". Google Code. May 10, 2011. Retrieved September 28, 2014.
  6. ^ "Bug 994134 – Warn first-time users on pasting code into the console". Bugzilla. Mozilla Foundation. April 9, 2014. Retrieved September 28, 2014.
  7. ^ "Issue 345205: DevTools: Combat self-XSS". Google Code. May 10, 2011. Retrieved September 28, 2014.
  8. ^ "What do Self-XSS scams look like?". Facebook Help. Facebook. July 11, 2014. Retrieved September 27, 2014.
  9. ^ "What is Self-XSS?". Facebook Help. Facebook. July 15, 2014. Retrieved September 27, 2014.
  10. ^ Ilascu, Ionut (July 28, 2014). "Hackers Trick Facebook Users into Self Cross-Site Scripting (XSS) Scam". Softpedia. SoftNews NET SRL. Retrieved September 27, 2014.

Further reading

[edit]