Don't trust the DOM: Bypassing XSS mitigations via script gadgets
summary
Claims that script gadgets — legitimate JS that upgrades benign DOM nodes into code — let attackers bypass most XSS mitigations. Research analyzes 16 popular libraries (angular aralia bootstrap react closure library polymer etc.), runs an automated crawl of the Alexa top 5,000, and verifies about 285000 gadgets across sites, finding gadget flows on ~82% of pages and exploitable gadget-driven bypasses in ~53% of library+mitigation combos. Tools include a Chrome/Firefox tracking engine, an exploit generator, and a Trusted Types prototype in Chrome Canary.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:39OWASP Agenda
- 2:02OWASP Cross-Site-Scripting (XSS) primer
- 3:46OWASP Isn't XSS a solved problem?
- 4:41OWASP How do mitigations work?
- 8:50OWASP Modern Applications - Example
- 11:04OWASP What are Script Gadgets?
- 12:06OWASP Attacker model
- 13:07OWASP Methodology
- 13:47OWASP Bypassing WAFS & XSS filters
- 17:51OWASP Bypassing HTML sanitizers
- 19:22OWASP Bypassing Content Security Policy
- 21:21OWASP Bypassing CSP strict dynamic
- 24:14OWASP Gadgets in expression parsers
- 30:13OWASP Empirical Study
- 30:35OWASP Research Questions
- 30:47OWASP Script Gadgets in user land code
- 32:59OWASP Gadgets effectiveness - user land code
- 34:46OWASP Root Cause Analysis
- 36:38OWASP Example
- 37:51OWASP Challenges
- 39:08OWASP Call to arms
- 39:29OWASP Summary
related talks
01h 01mClient-Side Protection Against DOM-Based XSS Done Right (tm)
40mClient-Side Protection Against DOM-Base...
23mJavaScript attack surface
55mCall To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering
34mJS Security - A Pentesters Perspective
42mEverything you need to know about client-side malicious code execution
29mFinding and Fixing DOM-based XSS - with Static Analysis
32mWriting Secure JavaScript Code