mXSS Attacks¶
Heiderich, M., Schwenk, J., Frosch, T., Magazinius, J., & Yang, E. Z. (2013). mXSS Attacks: Attacking Well-Secured Web-Applications by Using innerHTML Mutations. Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security, 777-788.
Cited by¶
1 citation across 1 artifact.
Each citation links to the sentence it supports in the citing article.
Mechanisms¶
- Template or Markup Sandbox
- Its sharpest failure mode is mutation XSS: when a string a sanitizer deemed safe is re-parsed by a different (browser) parser that reads the bytes differently, inert-looking content can re-materialize as active.
This sourceShows how browser DOM mutation can turn filtered, initially harmless markup into active cross-site-scripting content.
- Its sharpest failure mode is mutation XSS: when a string a sanitizer deemed safe is re-parsed by a different (browser) parser that reads the bytes differently, inert-looking content can re-materialize as active.
Verification¶
This reference passed the adversarial substantiation pipeline: it was checked to exist and to support the claim it is attached to. See how references were verified.
Registry ID ref:8340f26bd930 · see in the full table