id summary reporter owner description type status priority milestone component version resolution keywords cc launchpad_bug 1859 Proof-of-concept attack: Upload and execute attacker controlled js from any domain. nejucomo davidsarah "**Proof of Concept Attack** The following proof of concept shows how an html file loaded from any domain into (some) browsers with javascript enabled can inject an attacker controlled script into a grid, and //then// cause the user to execute that script in the domain of the grid: {{{

demo attack:

This page attempts to inject an attacker controlled script into a tahoe-lafs grid, no matter which domain this file is loaded from.

}}} **Mitigations**: There are several moving parts at work here. The {{{when_done}}} parameter with uri substitution was very convenient. I think an upload capability would be the most consistent and thorough solution. Removing bits and pieces which may otherwise be useful, like {{{when_done}}}, feels like a piecemeal defense. Requiring CSRF tokens may be more comprehensive, but also doesn't sit well with the rest of the capability model. (A CSRF token would be a bit like a ""make a this kind of http request"" temporary capability.) **Related Tickets**: * #615 is about illicitly gaining victim capabilities; whereas this ticket is about bootstrapping an attack and/or abusing ambient authority. * #1215 is about adding CORS support and how that may create a vulnerability; this script demonstrates even without CORS support similar vulnerabilities already exist. " defect new major undecided code-frontend-web 1.9.2 security javascript same-origin capleak websec frederik.braun+tahoe@…