Re: Cross Domain XMLHttpRequest

[Michal Zalewski <lcamtuf () dione ids pl>]

On Sun, 15 Apr 2007, Michal Majchrowicz wrote:

> I wanted to show that it is posssible to perform some kind of Cross
> Domain Requests.

As much as I loathe the origin-based security model of modern web
browsers, there are semi-valid reasons why XMLHttpRequest is restricted
the way it is.

A remote attacker can interact with much of the Internet on its own. Your
browser is an asset for him for three primary reasons:

  1) It might have access to a network that is not directly reachable
     from the Internet, for example a corporate LAN,

  2) It might be in possession of authentication tokens that enable it
     to access resources the attacker has no access to (web cookies,
     basic/NTLM credentials).

  3) It might serve as a bounce host to hide the actual source of an
     attack against a third-party site (or, say, even simply adding
     spam to web forums).

For these reasons, you do not want your browser to roam the Internet on
its own, and all mechanisms that allow this should be restricted. This is
already broken, of course - blind XSRF attacks are possible with plain
HTML - but unrestricted XMLHttpRequest would be a powerful, non-blind, and
fully interactive method that would be nearly impossible to stop.

Your script does not invalidate the need for XMLHttpRequest restrictions -
note that there is nothing for you to be gained from running it on your
server: you won't see more network than you can see already, you will not
receive cookies or other credentials that were not meant for you, and you
won't be able to hide your identity while attacking others.

Some web developers may benefit from such a bouncer, of course - but this
is really not a security-related topic; and still, they should be
cautious, because they might end up turning their system in a nifty zombie
host.

/mz

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/